• [REGRESSION 6.18.54 -> 6.18.63] cfg80211 / mt7925e: Invalid "Country: EU" beacon forces regdom to 98 and breaks AP/5GHz

[Martin Moosbauer <martinmoosbauer@vivaldi.net>]

Hi all,

I am reporting a regulatory regression on a MediaTek MT7925 (mt7925e) 
wireless card caused by neighboring ISP routers (Vodafone Germany / 
CommScope-Arris RDK-B) broadcasting an invalid 802.11d Country IE set to 
"EU".

This worked cleanly on Arch Linux kernel `6.18.54-2-lts`, where the 
system stayed on `DE` even after scanning the neighboring `EU` beacons. 
After updating to `6.18.63-2-lts` (and also reproducible on 
`7.2.8.zen1-2` and `7.3.4-zen2-1-zen`), the regulatory domain 
immediately falls back to `98` (`DFS-UNSET`), enforcing `PASSIVE-SCAN` 
across all 5 GHz channels and breaking AP/hotspot startup as well as 
manual scans.

### Problem Description
1. Neighboring Vodafone Station routers (OUI 4c:12:65, CommScope/Arris) 
broadcast `Country: EU` in their beacons (both on private SSIDs and 
public "Vodafone Hotspot" / "Vodafone Homespot" virtual BSSs). Note: 
Neighboring Vantiva/Technicolor Vodafone Stations (OUI 98:9d:5d) omit 
the Country IE and do not trigger this issue.
2. On kernel `6.18.54-2-lts`, `cfg80211` / `mt7925e` stayed on `DE` when 
seeing these beacons alongside valid `DE` routers. Both AP/hotspot and 5 
GHz STA modes worked without issues, and manual scans (`iw dev wlp8s0 
scan`) succeeded.
3. On kernel `6.18.63-2-lts` (as well as `7.2.8` and `7.3.4`), as soon 
as background scans pick up the `Country: EU` beacon, the active 
regulatory domain is overwritten with `98` (`DFS-UNSET`). All 5 GHz 
channels are restricted to `PASSIVE-SCAN`, preventing AP startup and 
causing manual scans (`iw dev ... scan`) to fail with `command failed: 
Device or resource busy (-16)`. Manually running `iw reg set DE` is 
immediately reverted on the next background scan.

### Expected Behavior
An invalid or non-ISO country code like "EU" received from an 
unassociated/neighboring AP beacon should be ignored/discarded by 
`cfg80211` (matching the `6.18.54-2-lts` behavior) rather than 
overriding a valid active regulatory domain (`DE`) with `98`.

### System Information
- Distribution: Arch Linux
- Last known working kernel: `6.18.54-2-lts`
- Affected kernels: `6.18.63-2-lts`, `7.2.8.zen1-2`, `7.3.4-zen2-1-zen`
- Hardware / Driver: MediaTek MT7925 (`mt7925e`, ASIC revision 
`79250000`)
- Firmware version: `HW/SW Version: 0x8a108a10, Build Time: 
20260813113015a` / `WM Firmware Version: ____000000, Build Time: 
20260813113118` (`linux-firmware 20261019-1`)
- `wireless-regdb` version: `2026.09.03-1`
- `iw` version: `6.17-1`

### Regulatory Output (`iw reg get` after boot on 6.18.63-2-lts)
global
country 98: DFS-UNSET
	(2402 - 2472 @ 40), (N/A, 20), (N/A)
	(2457 - 2482 @ 25), (N/A, 20), (N/A), PASSIVE-SCAN
	(2474 - 2483 @ 9), (N/A, 20), (N/A), NO-OFDM, PASSIVE-SCAN
	(5170 - 5250 @ 80), (N/A, 20), (N/A), NO-OUTDOOR, AUTO-BW, PASSIVE-SCAN
	(5250 - 5330 @ 80), (N/A, 20), (0 ms), NO-OUTDOOR, DFS, AUTO-BW, 
PASSIVE-SCAN
	(5490 - 5725 @ 160), (N/A, 20), (0 ms), DFS, PASSIVE-SCAN
	(5725 - 5730 @ 5), (N/A, 13), (0 ms), DFS, PASSIVE-SCAN
	(5735 - 5835 @ 80), (N/A, 13), (N/A), PASSIVE-SCAN
	(57240 - 63720 @ 2160), (N/A, 0), (N/A)

### Relevant Scan Dump Output
BSS 4c:12:65:ba:9b:8c(on wlp8s0_2)
	SSID: *SSID Deleted for Privacy reasons*
	Country: EU	Environment: Indoor/Outdoor
		 * OBSS non-GF present: 0
		 * BSS Transition
BSS 4e:12:65:ba:9b:9c(on wlp8s0_2)
	SSID: Vodafone Hotspot
	Country: EU	Environment: Indoor/Outdoor
		 * OBSS non-GF present: 0
BSS 4e:12:65:ba:9b:bc(on wlp8s0_2)
	SSID: Vodafone Homespot
	Country: EU	Environment: Indoor/Outdoor
		 * OBSS non-GF present: 0

Any guidance or patch to restore the `6.18.54` behavior and prevent 
unassociated invalid "EU" beacons from poisoning the active regulatory 
domain would be greatly appreciated.

Best regards,
Martin Moosbauer