161/udp (SNMP) and 69/udp (TFTP) Open closed under privileged scan. An earlier unprivileged probe falsely flagged 69/udp; the authoritative privileged scan corrected it.