diff --git a/.claude/memory/MEMORY.md b/.claude/memory/MEMORY.md
index b1dd9e2f..3e6f3344 100644
--- a/.claude/memory/MEMORY.md
+++ b/.claude/memory/MEMORY.md
@@ -237,3 +237,4 @@
 - [Claude Code Bun crash -> pin 2.1.110](reference_claude_code_bun_crash_pin.md) - v2.1.114+ segfaults on Win11 at new-session start; npm pin 2.1.110 + DISABLE_AUTOUPDATER=1; unpin on #55219 fix
 - [GuruRMM build-server SSH key](reference_gururmm_build_server_ssh.md) — guru@172.16.3.30 key is ~/.ssh/gururmm-physical (not id_*); password fallback vault infrastructure/gururmm-server
 - [LAB-SVR is current](feedback_labsvr_retired.md) — Len's Auto LAB-SVR is the CURRENT server (replaced old LAB-SERVER); powered back on 2026-07-18
+- [Datto AV uses Bitdefender drivers](feedback_datto_av_bitdefender_drivers.md) — rtp1/rtp2/BdNet/BdSentry/netprotection_network_filter* are Datto AV's own drivers (Bitdefender SDK), NOT orphan Avira installs; check infocyte SDK dir before treating as orphans
diff --git a/errorlog.md b/errorlog.md
index 52954e23..6ae7f46e 100644
--- a/errorlog.md
+++ b/errorlog.md
@@ -19,6 +19,8 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure ·
 
 <!-- Append entries below this line -->
 
+2026-07-20 | Howard-Home | rmm | [correction] Misidentified Datto AV kernel drivers (rtp1/rtp2/rtp_elam/BdNet/BdSentry/netprotection_network_filter*) as orphan Avira/Bitdefender leftovers. Datto AV uses the Bitdefender Endpoint Protection SDK under the hood, so these drivers are signed by Avira Operations GmbH but belong to Datto AV. Disabled and deleted them, breaking Datto AV. Had to restore from the SDK backup dir. Always check C:Program Filesinfocytegentdattoav before assuming BD/Avira drivers are orphans. [ctx: ref=maintenance-pc-cascades machine=MAINTENANCE-PC]
+
 2026-07-20 | Howard-Home | rmm | [friction] Rebooted MAINTENANCE-PC (Wi-Fi only, no ethernet) into Safe Mode minimal -- agent lost connectivity, requires on-site visit to recover. Should have checked network adapter type before choosing safeboot. Wi-Fi devices cannot use Safe Mode for remote driver cleanup. [ctx: ref=maintenance-pc-cascades machine=MAINTENANCE-PC]
 
 2026-07-20 | Howard-Home | screenconnect | ScreenConnect API error [GetSessionDetailsBySessionID]: HTTP 500: {"errorType":"ArgumentException","message":"Unable to convert arguments to corresponding parameter types: Error converting value "0cad0ad0-18ae-4693-9" to type 'System.Guid'. Path ''."} [ctx: cmd=session]