diff --git a/AI.md b/AI.md
index bfc7e09..5202fd9 100644
--- a/AI.md
+++ b/AI.md
@@ -766,4 +766,25 @@ Latest endpoint audit checkpoint from patch 0235:
 - Remaining `123/40` and higher protocol-stack, router/SAP, server/set-command,
   and compression information selectors still need later follow-up auditing.
 
-Next patch number should be `0236`.
+Latest endpoint audit checkpoint from patch 0236:
+
+- SDK `0x2222/123` / wire `0x7b` server information/statistics now records the
+  protocol-stack/media selector run behind `MARS_NWE_4` in `src/nwconn.c`:
+  `123/40` Active Protocol Stacks, `123/41` Get Protocol Stack Configuration
+  Information, `123/42` Get Protocol Stack Statistics Information, `123/43`
+  Get Protocol Stack Custom Information, `123/44` Get Protocol Stack Numbers
+  by Media Number, `123/45` Get Protocol Stack Numbers by LAN Board Number,
+  `123/46` Get Media Name by Media Number, and `123/47` Get Loaded Media
+  Number.
+- This block was checked against the local NDK/Core Protocols PDF plus the
+  uploaded WebSDK/include `nwfse` material.  PDF/WebSDK/includes jump from
+  `123/47` to the router/SAP group at `123/50`; do not invent `123/48` or
+  `123/49` selector slots unless a new primary source is found.
+- Future ownership remains the `servermgmt`/information provider boundary with
+  transport/provider input for real protocol-stack/media binding state.  Do not
+  synthesize fake protocol stacks, LAN bindings, or loaded media types, and do
+  not route these read-only data-plane requests through `nwserv`.
+- Remaining `123/50` and higher router/SAP, server/source/set-command, and
+  compression information selectors still need later follow-up auditing.
+
+Next patch number should be `0237`.
diff --git a/TODO.md b/TODO.md
index 882a404..a0a4c12 100644
--- a/TODO.md
+++ b/TODO.md
@@ -281,10 +281,15 @@ SDK-listed blocks that do not currently show a top-level handler in
   Media Manager / volume selector run: `123/30` Get Media Manager Object
   Information, `123/31` Get Media Manager Objects List, `123/32` Get Media
   Manager Object Children's List, `123/33` Get Volume Segment List, and
-  `123/34` Get Volume Information by Level.  The remaining `123/40` and higher
-  protocol-stack, router/SAP, set-command, server/source, and compression
-  information selectors still need follow-up auditing before any additional
-  stubs are added.
+  `123/34` Get Volume Information by Level.  Patch 0236 adds the
+  protocol-stack/media selector run: `123/40` Active Protocol Stacks, `123/41`
+  Get Protocol Stack Configuration Information, `123/42` Get Protocol Stack
+  Statistics Information, `123/43` Get Protocol Stack Custom Information,
+  `123/44` Get Protocol Stack Numbers by Media Number, `123/45` Get Protocol
+  Stack Numbers by LAN Board Number, `123/46` Get Media Name by Media Number,
+  and `123/47` Get Loaded Media Number.  The remaining `123/50` and higher
+  router/SAP, set-command, server/source, and compression information selectors
+  still need follow-up auditing before any additional stubs are added.
 
 Follow-up:
 
diff --git a/src/nwconn.c b/src/nwconn.c
index 3643348..7f3a6ea 100644
--- a/src/nwconn.c
+++ b/src/nwconn.c
@@ -7724,6 +7724,50 @@ static int handle_ncp_serv(void)
                                   * Treat InfoLevelNumber as a payload selector,
                                   * not a separate wire subfunction.
                                   */
+                      case 0x28: /* 123/40 Active Protocol Stacks.
+                                  * Request carries StartNumber.
+                                  * Reply carries max/count/nextStartNum plus
+                                  * StackNum and StackShortName entries.
+                                  */
+                      case 0x29: /* 123/41 Get Protocol Stack Configuration
+                                  * Information.
+                                  * Request selects StackNumber.  Reply carries
+                                  * config/stack versions and the stack short
+                                  * name.
+                                  */
+                      case 0x2a: /* 123/42 Get Protocol Stack Statistics
+                                  * Information.
+                                  * Request selects StackNumber.  Reply carries
+                                  * common TX/RX/ignored packet counters plus
+                                  * the custom-counter count.
+                                  */
+                      case 0x2b: /* 123/43 Get Protocol Stack Custom
+                                  * Information.
+                                  * Request selects StackNumber and StartNumber.
+                                  * Reply carries custom protocol-stack counter
+                                  * entries and requires provider-backed
+                                  * protocol statistics before activation.
+                                  */
+                      case 0x2c: /* 123/44 Get Protocol Stack Numbers by
+                                  * Media Number.
+                                  * Request selects MediaNumber.  Reply lists
+                                  * stack IDs bound to that media type.
+                                  */
+                      case 0x2d: /* 123/45 Get Protocol Stack Numbers by LAN
+                                  * Board Number.
+                                  * Request selects BoardNumber.  Reply lists
+                                  * protocol stack IDs bound to the LAN board.
+                                  */
+                      case 0x2e: /* 123/46 Get Media Name by Media Number.
+                                  * Request selects MediaNumber.  Reply carries
+                                  * the length-prefixed media name.
+                                  */
+                      case 0x2f: /* 123/47 Get Loaded Media Number.
+                                  * Request carries StartNumber.  Reply carries
+                                  * max/count and a loaded-media number list.
+                                  * Keep this with the protocol-stack/provider
+                                  * model; do not synthesize fake media types.
+                                  */
                                completition = 0xfb;
                                break;
                       default: completition = 0xfb;