MT7925 native Wi-Fi front end: what moved, 2026-10-22 to 2026-10-23

f0xeri/qwz-macos v0.0.26 (GPL-2.0, ideas only for our ISC front end) made wdutil and the Wi-Fi menu show 802.11ax, MCS, streams and the guard interval on 25G241. The commits say exactly which requests did it:

• 24deccaf: getMCS_VHT (slot 482, ioctl 0xc3), a packed {version, mcs, nss, bw in MHz, gi 400 or 800}. Once VHT or HE elements are in the current network's IEs, macOS asks this one and fails MCS, NSS and GI when it is unsupported.
• 626432da: getMCS (479, 0x39) and getGUARD_INTERVAL (478, 0x37).
• 1eca16a8: CARD_CAPABILITIES byte 0x15 bit 7 when HE is on; their reading of the KC is that WCLDeviceConfiguration::isHeSupported checks it.
• 77a2912c: HT Operation, VHT and HE Capabilities in scan-result IEs; the network's PHY mode is derived from those elements, getPHY_MODE is not asked on Tahoe.

On our side (src/MtkWlanNativeReq.cpp): getCHANNEL always answers 20 MHz although the core's mtk_link_info already carries bw, center and nss; the MCS, NSS and GI slots are stubs; and commandAllowed() refuses 0x37, 0x39, 0xc3 and 0x161 before any slot runs. That is the fix list for #1, except the scan-list width, which qwz also still reports as 20 MHz (Scan.hpp:70). Effect High, KC reasoning Medium.

thanhnndev's awdl-tahoe branch (Clear BSD, their clean-room itlmt7925Native, same chip and build as ours, not a fork of our kexts) is the most concrete AWDL work we have seen for a native Tahoe driver. From docs/ROADMAP-AWDL.md sections 9 and 10, with the panics and traces that back each step:

• wifip2pd creates awdl0 itself with VIRTUAL_IF_CREATE (ioctl 0x5e, role 6) once the controller's command gate lets the AWDL ioctl range through. The virtual interface must subclass IO80211AWDLProtocol with BSD prefix awdl, created in the order of section 9.5; the Family then builds IO80211AWDLPeerManager itself.
• configure() aborts at the first unsupported setter (slot 540, setAWDL_BSSID, comes first); the channel sequence, master channel and sync state are echoed back.
• The Family never sends action frames. The driver builds PSF and MIF frames from the sync-frame TLV and sends them at 6 Mb/s inside a ROC window on channels 6, 44 and 149. Receive needs the firmware sniffer, and frames go to actionFrameInput (slot 73) in IO80211DynamicBufferPool buffers, the "dynamic-pool AWDL RX fix" of 7759e803 merged in c98bcff8: a static pool panics in flushPool and a malloc pool's buffers lack writeBytes.
• Where it stands: real peer frames reach the peer manager, peers:0, AirDrop not working; the 2026-10-23 boot outcome is not recorded. An iPhone only starts AWDL after a BLE advertisement, so two Macs are the cleaner test.

Code High, their KC offsets Medium, outcome Unverified. The code is reusable with attribution, which our NOTICE already carries for their 24H32 work.

kgp-macPro/AirportItlwm-Tahoe (GPL-2.0, 21 stars) is not what its description suggests: it is upstream itlwm built for Ventura's legacy IO80211FamilyLegacy under OCLP root patches, and its only AWDL change removes the Ventura early return in setVIRTUAL_IF_CREATE and attaches a legacy IO80211P2PInterface named awdl. No action frames, no sync, no AirDrop claim. Nothing in it applies to a Tahoe-native driver. High.

Two more AWDL attempts appeared in the window, neither shown working: Dino-VN/SimpleMtkWlan (an awdl branch on a MediaTek Skywalk front end for Tahoe) and Youtubefan01/airportitlwmtahoe (an IO80211AWDLProtocol class for AX210, measured against 26.5, never loaded; its note that a virtual interface which does not redeclare the framework's overridden slots gets the base createPeerManager is worth keeping). Their slot numbers differ from thanhnndev's by 2 to 3, so re-check before reuse.

• A first WPA2-PSK join on air with the native front end came from oliverchu on an AM5 desktop (COLORFUL BATTLE-AX B850M-PLUS S WIFI7, RZ717) in #3. The README now says so and credits him (a3c444a); the logs are in logs/oliverchu/. High.
• New projects, both studied only: HuajiFruit/AirportBZ, itlwm for Intel BE201 on the real IO80211Family and IOSkywalkFamily (scan, WPA2 and DHCP on Sequoia; no WPA3, 6 GHz or AWDL; GPL-2.0), and ofonsecavictor/aic-8800d80-macos, an AIC8800D80 USB dongle with its own en2 on Sequoia, tested on one machine, with AirDrop notes in docs/airdrop-aic-research.md and no licence file. Medium.