mt7996 AP Stops Beaconing after Channel Switch with 6.17+

[Alex Gavin <alex.gavin@candelatech.com>]

Hi there. When performing an AP channel switch using a mt7996 radio, 
6.17+ kernels and latest hostapd (both vanilla), the AP stops beaconing 
shortly after switching channels. The issue occurs regardless of band 
and notably does not occur when using other radios like the mt7915 with 
the same kernel and hostapd.

The following command is used to trigger the channel switch from the 
hostapd CLI. Running the 'update_beacon' command after restores the AP 
back to beaconing state on the new channel. Config file used available 
here [1].

chan_switch 3 5745 sec_channel_offset=1 center_freq1=5775 bandwidth=80 he

Interestingly, the CSA count matches the number of beacons sent on the 
new channel before stopping. In each of these beacons on the new 
channel, the destination MAC is sent with the first octet modified, 
which looks a lot like the CSA count decrementing.

For example with CSA count set to three (edited for readability) using a 
5 GHz AP initially configured to 5180 MHz switching to 5745 MHz a packet 
capture shows the following:

$ tshark -r capture.pcapng
xx:_:xx -> Broadcast         5180MHz ...  Beacon frame <- non-CSA
xx:_:xx -> Broadcast         5180MHz ...  Beacon frame <- CSA 3
xx:_:xx -> Broadcast         5180MHz ...  Beacon frame <- CSA 2
xx:_:xx -> Broadcast         5180MHz ...  Beacon frame <- CSA 1
xx:_:xx -> 03:ff:ff:ff:ff:ff 5745MHz ...  Beacon frame <- new channel
xx:_:xx -> 02:ff:ff:ff:ff:ff 5745MHz ...  Beacon frame
xx:_:xx -> 01:ff:ff:ff:ff:ff 5745MHz ...  Beacon frame
(nothing)

This has made for interesting 'spelunking' through the channel switching 
and beacon configuration infrastructure. However, I'm not confident I 
can come up with a fix in any sort of reasonable timeframe. I'd be happy 
to test any proposed fix and/or share any further information needed 
(e.g. 'trace-cmd' output).

[1] 
https://codeberg.org/a-gavin/hostap-confs/src/branch/main/wpa2/hostapd_5GHz-wpa2.conf