diff --git a/rtl837x_port.c b/rtl837x_port.c
index e3600eba..6cbc5870 100644
--- a/rtl837x_port.c
+++ b/rtl837x_port.c
@@ -271,7 +271,7 @@ void vlan_setup(void) __banked
 	wait_table_ready();
 
 	// Set PVID 1 for every port. TODO: Skip unused ports!
-	for (uint8_t i = machine.min_port; i <= machine.max_port + 1; i++) {  // Do this also for the CPU port (+1)
+	for (uint8_t i = machine.min_port; i <= CPU_PORT; i++) { // CPU MAC is independent of the last user port
 		uint16_t reg = RTL837x_PVID_BASE_REG + ((i >> 1) << 2);
 #ifdef DEBUG
 		print_byte(i); write_char(':'); write_char(' '); print_short(reg); write_char('=');
@@ -307,7 +307,7 @@ void vlan_setup(void) __banked
 	REG_SET(RTL837X_VLAN_L2_LRN_DIS_0, 0);
 	REG_SET(RTL837X_VLAN_L2_LRN_DIS_1, 0);
 
-	// Enable VLAN 1: Ports 0-9, i.e. including the CPU port are untagged members
+	// Enable VLAN 1: user ports untagged, CPU MAC9 tagged (untag bit 19 clear)
 	REG_SET(RTL837x_TBL_DATA_IN_A, machine_detected.isRTL8373? 0x0207ffff : 0x0207e3f8);	// 02: Entry valid, 7...: membership
 
 	REG_SET(RTL837X_TBL_CTRL, 0x00010303);	// Write VLAN 1
diff --git a/test/cpu_vlan.mk b/test/cpu_vlan.mk
new file mode 100644
index 00000000..c03def88
--- /dev/null
+++ b/test/cpu_vlan.mk
@@ -0,0 +1,10 @@
+# Invoke: make -C test -f Makefile -f cpu_vlan.mk run-cpu-vlan
+CPU_TESTS=build/test_cpu_vlan_full build/test_cpu_vlan_restricted build/test_cpu_vlan_8372
+build/test_cpu_vlan_full: test_cpu_vlan.c $(TABLE_ENV) | build
+	$(CC) $(CFLAGS) -no-pie $(filter %.c,$^) -o $@ $(LDFLAGS)
+build/test_cpu_vlan_restricted: test_cpu_vlan.c $(TABLE_ENV) | build
+	$(CC) $(CFLAGS) -no-pie -DRTLP_TEST_MAX_PORT=7 $(filter %.c,$^) -o $@ $(LDFLAGS)
+build/test_cpu_vlan_8372: test_cpu_vlan.c $(TABLE_ENV) | build
+	$(CC) $(CFLAGS) -no-pie -DRTLP_TEST_MAX_PORT=7 -DRTLP_TEST_MIN_PORT=3 -DRTLP_TEST_IS8373=0 $(filter %.c,$^) -o $@ $(LDFLAGS)
+run-cpu-vlan: $(CPU_TESTS)
+	@for t in $(CPU_TESTS); do $$t || exit 1; done
diff --git a/test/env_tables.c b/test/env_tables.c
index 41694b72..b7f80529 100644
--- a/test/env_tables.c
+++ b/test/env_tables.c
@@ -56,15 +56,24 @@ const uint8_t hex_chars[] = "0123456789abcdef";
 uint8_t *hex = (uint8_t *)hex_chars;
 
 /* ---- a 9-port RTL8373 whose logical ports map to themselves ---- */
+#ifndef RTLP_TEST_MAX_PORT
+#define RTLP_TEST_MAX_PORT 8
+#endif
+#ifndef RTLP_TEST_MIN_PORT
+#define RTLP_TEST_MIN_PORT 0
+#endif
+#ifndef RTLP_TEST_IS8373
+#define RTLP_TEST_IS8373 1
+#endif
 const struct machine machine = {
 	.machine_name = "HOSTTEST",
-	.min_port = 0,
-	.max_port = 8,
+	.min_port = RTLP_TEST_MIN_PORT,
+	.max_port = RTLP_TEST_MAX_PORT,
 	.n_sfp = 0,
 	.log_to_phys_port = { 1, 2, 3, 4, 5, 6, 7, 8, 9 },
 	.phys_to_log_port = { 0, 1, 2, 3, 4, 5, 6, 7, 8 },
 };
-struct machine_runtime machine_detected = { .isRTL8373 = 1 };
+struct machine_runtime machine_detected = { .isRTL8373 = RTLP_TEST_IS8373 };
 
 /* ---- firmware state the modules read or write ---- */
 uint8_t  outbuf[TCP_OUTBUF_SIZE];
diff --git a/test/test_cpu_vlan.c b/test/test_cpu_vlan.c
new file mode 100644
index 00000000..f1ca6d0b
--- /dev/null
+++ b/test/test_cpu_vlan.c
@@ -0,0 +1,24 @@
+#include <stdint.h>
+#include <stdio.h>
+#include "rtl837x_common.h"
+#include "rtl837x_port.h"
+#include "machine.h"
+#include "support.h"
+#include "hw_mock.h"
+extern const struct machine machine;
+extern struct machine_runtime machine_detected;
+int main(void) {
+ hw_reset();out_reset();
+ hw_reg_set(RTL837X_VLAN_PORT_EGR_TAG,0xa50fffff);
+ hw_reg_set(RTL837x_PVID_BASE_REG+16,0x5a123456);
+ vlan_setup();
+ uint32_t untouched=(1u<<(machine.min_port*2))-1;
+ CHECK(hw_reg_get(RTL837X_VLAN_PORT_EGR_TAG)==(0xa5000000|untouched),"CPU egress set, unrelated bits preserved");
+ CHECK(hw_reg_get(RTL837x_PVID_BASE_REG+16)==0x5a001001,"CPU PVID initialized explicitly");
+ uint16_t active=((1u<<(machine.max_port+1))-1)&~((1u<<machine.min_port)-1);
+ CHECK(hw_reg_get(RTL837X_VLAN_PORT_IGR_FLTR)==(active|PMASK_CPU),"CPU ingress included, excluded user ports rejected");
+ CHECK(hw_vlan_word(1)==(machine_detected.isRTL8373?0x0207ffff:0x0207e3f8),"existing family VLAN membership preserved");
+ CHECK(hw_vlan_word(2)==0,"no unrelated VLAN changed");
+ printf("CPU VLAN min=%u max=%u RTL8373=%u: %d checks, %d failed\n",machine.min_port,machine.max_port,machine_detected.isRTL8373,tests_run,tests_failed);
+ return tests_failed?1:0;
+}