While debugging some issues with neighbor query action frames, I ran into an interesting set of issues. For reasons I do not yet understand, sometimes wpa_supplicant has bss->freq == 0 when associated, and so sending an action frame chooses to send a 'command' frame instead of an mlme frame, because it thinks we are doing off-channel tx. When this happens, I end up seeing the action frame sent out on TID 6 in the ath10k firmware. This fails to send for a variety of reasons. When supplicant evidently has the proper bss->freq, then action frames go through the mlme code path, and then I see frames hit the ath10k firmware on the mgt tid as expected. I can hack around this in several different places, but in hopes of doing this more correctly: What exactly is supposed to configure the TID for off-channel TX? Thanks, Ben -- Ben Greear <greearb@xxxxxxxxxxxxxxx> Candela Technologies Inc http://www.candelatech.com