after installing wireguard (kernel upgrade + headers) the pi would no longer boot and fail with crc error.

 

Looking at the boot partition the uinitrd file was linked to the old version.

 

Changed the uinitrd link to the newest one and it booted again.

 

12 minutes ago, darkdrgn2k said:

after installing wireguard

do not install WG it as:
- its already present in all kernels

Spoiler

armbian:kernel:% grep WIREGUARD= *                                                                                                                  <AR-2004>
linux-arm64-sc8280xp.config:CONFIG_WIREGUARD=m
linux-arm64-sc8280xp.config.defconfig:CONFIG_WIREGUARD=m
linux-arm64-sm8250.config:CONFIG_WIREGUARD=m
linux-bcm2711-current.config:CONFIG_WIREGUARD=m
linux-bcm2711-edge.config:CONFIG_WIREGUARD=m
linux-bcm2711-legacy.config:CONFIG_WIREGUARD=m
linux-d1-edge.config:CONFIG_WIREGUARD=m
linux-d1-edge.config.defconfig:CONFIG_WIREGUARD=m
linux-imx6-current.config:CONFIG_WIREGUARD=m
linux-imx6-current.config.defconfig:CONFIG_WIREGUARD=m
linux-imx6-edge.config:CONFIG_WIREGUARD=m
linux-imx6-edge.config.defconfig:CONFIG_WIREGUARD=m
linux-imx6-legacy.config:CONFIG_WIREGUARD=m
linux-imx6-legacy.config.defconfig:CONFIG_WIREGUARD=m
linux-imx7d-current.config:CONFIG_WIREGUARD=m
linux-imx7d-legacy.config:CONFIG_WIREGUARD=m
linux-media-current.config:CONFIG_WIREGUARD=m
linux-media-current.config.defconfig:CONFIG_WIREGUARD=m
linux-media-edge.config:CONFIG_WIREGUARD=m
linux-media-edge.config.defconfig:CONFIG_WIREGUARD=m
linux-media-legacy.config:CONFIG_WIREGUARD=m
linux-media-legacy.config.defconfig:CONFIG_WIREGUARD=m
linux-meson64-current.config:CONFIG_WIREGUARD=m
linux-meson64-edge.config:CONFIG_WIREGUARD=m
linux-meson-current.config:CONFIG_WIREGUARD=m
linux-meson-current.config.defconfig:CONFIG_WIREGUARD=m
linux-meson-edge.config:CONFIG_WIREGUARD=m
linux-meson-edge.config.defconfig:CONFIG_WIREGUARD=m
linux-meson-s4t7-legacy.config:CONFIG_WIREGUARD=m
linux-mt7623-edge.config:CONFIG_WIREGUARD=m
linux-mt7623-legacy.config:CONFIG_WIREGUARD=m
linux-mvebu64-current.config:CONFIG_WIREGUARD=m
linux-mvebu64-edge.config:CONFIG_WIREGUARD=m
linux-mvebu-current.config:CONFIG_WIREGUARD=m
linux-mvebu-current.config.defconfig:CONFIG_WIREGUARD=m
linux-mvebu-edge.config:CONFIG_WIREGUARD=m
linux-mvebu-edge.config.defconfig:CONFIG_WIREGUARD=m
linux-mvebu-legacy.config:CONFIG_WIREGUARD=m
linux-odroidxu4-current.config:CONFIG_WIREGUARD=m
linux-odroidxu4-edge.config:CONFIG_WIREGUARD=m
linux-rk322x-current.config:CONFIG_WIREGUARD=m
linux-rk322x-edge.config:CONFIG_WIREGUARD=m
linux-rk322x-legacy.config:CONFIG_WIREGUARD=m
linux-rk35xx-legacy.config:CONFIG_WIREGUARD=m
linux-rockchip64-current.config:CONFIG_WIREGUARD=m
linux-rockchip64-current.config.defconfig:CONFIG_WIREGUARD=m
linux-rockchip64-edge.config:CONFIG_WIREGUARD=m
linux-rockchip64-edge.config.defconfig:CONFIG_WIREGUARD=m
linux-rockchip-current.config:CONFIG_WIREGUARD=m
linux-rockchip-current.config.defconfig:CONFIG_WIREGUARD=m
linux-rockchip-edge.config:CONFIG_WIREGUARD=m
linux-rockchip-edge.config.defconfig:CONFIG_WIREGUARD=m
linux-rockchip-rk3588-edge.config:CONFIG_WIREGUARD=m
linux-rockpis-legacy.config:CONFIG_WIREGUARD=m
linux-s5p6818-legacy.config:CONFIG_WIREGUARD=m
linux-starfive-edge.config:CONFIG_WIREGUARD=m
linux-station-p2-legacy.config:CONFIG_WIREGUARD=m
linux-sun50iw9-btt-legacy.config:CONFIG_WIREGUARD=m
linux-sun50iw9-legacy.config:CONFIG_WIREGUARD=m
linux-sunxi64-current.config:CONFIG_WIREGUARD=m
linux-sunxi64-edge.config:CONFIG_WIREGUARD=m
linux-sunxi64-edge.config.defconfig:CONFIG_WIREGUARD=m
linux-sunxi64-legacy.config:CONFIG_WIREGUARD=m
linux-sunxi-current.config:CONFIG_WIREGUARD=m
linux-sunxi-current.config.defconfig:CONFIG_WIREGUARD=m
linux-sunxi-edge.config:CONFIG_WIREGUARD=m
linux-sunxi-edge.config.defconfig:CONFIG_WIREGUARD=m
linux-sunxi-legacy.config:CONFIG_WIREGUARD=m
linux-sunxi-legacy.config.defconfig:CONFIG_WIREGUARD=m
linux-thead-edge.config:CONFIG_WIREGUARD=m
linux-uefi-arm64-current.config:CONFIG_WIREGUARD=m
linux-uefi-arm64-edge.config:CONFIG_WIREGUARD=m
linux-uefi-arm64-legacy.config:CONFIG_WIREGUARD=m
linux-uefi-riscv64-current.config:CONFIG_WIREGUARD=m
linux-uefi-riscv64-edge.config:CONFIG_WIREGUARD=m
linux-uefi-riscv64-legacy.config:CONFIG_WIREGUARD=m
linux-uefi-x86-current.config:CONFIG_WIREGUARD=m
linux-uefi-x86-edge.config:CONFIG_WIREGUARD=m
linux-uefi-x86-legacy.config:CONFIG_WIREGUARD=m
linux-virtual-current.config:CONFIG_WIREGUARD=m
linux-virtual-current.config.defconfig:CONFIG_WIREGUARD=m
linux-wsl2-arm64-current.config:CONFIG_WIREGUARD=y
linux-wsl2-arm64-edge.config:CONFIG_WIREGUARD=y
linux-wsl2-x86-current.config:CONFIG_WIREGUARD=y
linux-wsl2-x86-current.config.defconfig:CONFIG_WIREGUARD=y
linux-wsl2-x86-edge.config:CONFIG_WIREGUARD=y
linux-zynq-legacy.config:CONFIG_WIREGUARD=m

 

- as their postinst scripts installs kernel from Debian repository that is not suitable to run on this device ... which breaks the system.

I have exactly this problem on my OrangePiZero too.
In my case it's a 3 hour drive on the highway into the mountains at 1600 m and back again.
The problem happens because the Wireguard package was already installed before the update for remote maintenance. The update then replaces the kernel with one that no longer boots.
Luckily I only have 1 OrangePiZero.