Hi Andrei,

I tested v2 on an MT7925 PCIe card against a DD-WRT Wi-Fi 7 AP that
advertises three links (2.4, 5 and 6 GHz). Results below, in case they
help.

Setup:
- MT7925 PCIe (14c3:7925, subsystem 103c:8c94), firmware
  WIFI_RAM_CODE 20260813113118 / patch 20260813113015a
- Fedora 44, kernel 7.2.8-200.fc44; mt76 rebuilt out of tree from the
  7.2.8 sources with the patches listed below
- AP: <router model and DD-WRT build>, one MLO SSID with three links;
  WPA3-SAE
- wpa_supplicant 2.11 with hostap commit b048a294a ("MLD: Iterate
  per-link in wpa_clear_keys() for MLO group keys") backported; without
  it, every intra-MLD reconnect logged "link ID must be set for MLO
  group key" and often failed
- Test: 15 minutes, ~1 MB/s download, nl80211 rescan every 60 s,
  gateway ping plus HTTP probe every 5 s

Results:

1) Stock 7.2.8: a two-link (5+6 GHz) association stalled after about
   160 s. Traffic stopped without any disconnect, and a scan was left
   pending ("Reject scan trigger since one is already pending"). The
   same signature appeared after about 2 h on a 2.4+6 GHz association.

2) 7.2.8 + v2 alone: MLO associations failed (AP-side 4-way handshake
   timeouts). After MLO teardown, associations to a separate legacy
   SSID on the same AP were repeatedly deauthenticated by the AP with
   reason 6 (Class 2 frame received from nonauthenticated STA),
   followed by SA Query timeouts on the STA. This matches what
   "wifi: mt76: mt7925: restore the legacy BSS after MLO teardown"
   describes. I did not isolate whether v2 contributed.

3) 7.2.8 + the seven mt76 commits below + your v2 (eight patches in
   total): PASS. 900 s on a three-link (2.4+5+6 GHz) association:
   176/176 probes OK, no disconnects. All 61 full-band scans completed
   (median 8.4 s, max 10.0 s), none stuck.

     wifi: mt76: mt7925: guard BSS capability lookups
     wifi: mt76: check the owner of a remain-on-channel request
     wifi: mt76: mt7925: fix lock inversion between dev->mutex and iflist_mtx
     wifi: mt76: mt7925: check drv_pmctrl return in the PCIe reset path
     wifi: mt76: mt7925: restore the reset state when fw_pmctrl fails
     wifi: mt76: mt7925: fix the lock inversion in suspend and resume
     wifi: mt76: mt7925: restore the legacy BSS after MLO teardown

Caveats: this is a single 15-minute run on a backported 7.2.8 base,
and I did not bisect which of the commits above, besides v2, are
required. I'm continuing to run it day to day and can report back.

Tested-by: Tamer Ahmed <tbmostafa@yahoo.com>

Thanks for working on this.