nrf70 raw packet send fails silently with FC=0x0803 or if changing channel just prior to send?

RE: nrf70 raw packet send fails silently with FC=0x0803 or if changing channel just prior to send?

Håkon Alseth — Tue, 17 Mar 2026 14:18:27 GMT

Hi Brian,

Thank you for your patience in this matter. The team has acknowledged the issue, but I unfortunately am not able to give you a detailed timeline for when this will be addressed.

If this is a feature that is critical for your project, please send me a direct message, and I will share with you the contact details of the regional sales manager for your area.

Kind regards,

Håkon

RE: nrf70 raw packet send fails silently with FC=0x0803 or if changing channel just prior to send?

BrianW — Mon, 16 Mar 2026 10:32:25 GMT

while they are looking at it, it would also be very useful to remove the restriction that raw packets can only be sent on the same channel as the associated AP...

For wifi RTLS, the device is often both associated with an AP (for comms) and also needs to 'blink" with raw packets on multiple channels (for RTLS location).

thanks

Brian

RE: nrf70 raw packet send fails silently with FC=0x0803 or if changing channel just prior to send?

Håkon Alseth — Fri, 06 Mar 2026 13:26:06 GMT

Hi,

Thank you so much for your patience, and for testing and verifying.

I have added your test sequence to the internal bug tracker, and I will get back to you once R&D has looked into this. That can take a few business days.

Kind regards,

Håkon

RE: nrf70 raw packet send fails silently with FC=0x0803 or if changing channel just prior to send?

BrianW — Thu, 05 Mar 2026 16:48:51 GMT

Ok. So I tried with the raw_tx_packet sample from NCS 3.2.1 nrf/samples/wifi.

Updated the prj.conf to work with my custom board and added:

CONFIG_RAW_TX_PKT_SAMPLE_INJECTION_ENABLE=y

CONFIG_RAW_TX_PKT_SAMPLE_CONNECTION_MODE=n

CONFIG_RAW_TX_PKT_SAMPLE_INTER_FRAME_DELAY_MS=2000

Test 1 : tx raw packet with fc=0x0803 ie To-DS=1, From-DS=1

In main.c set the packet contents to be:

static struct beacon test_beacon_frame = {

.frame_control = htons(0x0803), // data frame, DS AP-AP. Note byte swapped

.duration = 0x0000,

.da = {0x01, 0x40, 0x96, 0x00, 0x00, 0x03},

// Transmitter Address: filled in with our MAC

.sa = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF},

.bssid = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00},

.seq_ctrl = 0x0010,

// Null SSID, no other IEs

.payload = {

0x00 , // Version = 1

0x0c , 0x01 , 0x0c , 0x01 , // tx power=12, channel=1, reg class=12, nburst = 1

0x02, 0x07, 0x21 , 0x02 , 0x58 , 0x00 , 0x00 , 0x00 , 0x00 , // Battery

0x05, 0x01 , 0x00 , // Emergency, panic button

0x04 , 0x20 , // Vendor specific, 32 bytes, vendor OUI is 00188e

0x00, 0x18 , 0x8e , 0x00 , 0x02 , 0x00 , 0x02 , 0x00 , 0x08 , 0x00 , 0x06 , 0x00 , 0x01 , 0x25 , 0x00 , 0x07 ,

0x00, 0x01 , 0x03 , 0x00 , 0x08 , 0x00 , 0x04 , 0x00 , 0x00 , 0x01 , 0x2c , 0x00 , 0x03 , 0x00 , 0x01 , 0x00

}

Result: NOK

- still silently drops this packet with the frame control To-DS and From-DS bits set to 1

Setting frame_control to 0x0800 works, packet seen on air.

Test 2 : setting channel just before sending:

Updated main.c to set the wifi channel from an array of {1,6,11} each time it attempts to tx.

Result : OK

- accepts to tx a packet when channel change done just before the sendto()

So the channel change issue seems to be fixed in 3.2.1, but still doesn't accept the frame control.

a) how can I get the raw packet fixes for channel change in 2.9.0?

b) why won't the raw packet tx accept To-DS/From-DS bits set?

RE: nrf70 raw packet send fails silently with FC=0x0803 or if changing channel just prior to send?

Håkon Alseth — Tue, 03 Mar 2026 09:43:44 GMT

Hi,

As initially mentioned, I understand that there are issues wrt. porting; but if you cut-down the sample and isolate the issue, this should be able to run without direct issues towards the problematic components that you list.

It would help greatly to test this on a newer version to see if the changes between your current version, and the latest, improves your scenario. Ie. to see if we are dealing with a known issue, or a completely new one.

Cherry-picking all the fixes has dependencies, so listing each commit will not be applied cleanly.

Kind regards,

Håkon

RE: nrf70 raw packet send fails silently with FC=0x0803 or if changing channel just prior to send?

BrianW — Mon, 02 Mar 2026 08:55:15 GMT

[quote userid="2115" url="~/f/nordic-q-a/127199/nrf70-raw-packet-send-fails-silently-with-fc-0x0803-or-if-changing-channel-just-prior-to-send/562241"]several fixes and improvements wrt. raw mode since the release of v2.9.0[/quote]

Do any of these fixes related to the problems I have?

Can you give me commit ids for these changes - I could try cherry picking them back to 2.9.0?

Like I say, the changes to 3.2.x are such that we will need to review and change ALL nrfx related code - see this ticket:

Migration from NCS 2.9.0 to NCS 3.2.1 is hard, not well documented and will break all nrfx code.

so even if the problem has been fixed on 3.2.1, its not going to help with the customer I have right now...

RE: nrf70 raw packet send fails silently with FC=0x0803 or if changing channel just prior to send?

Håkon Alseth — Fri, 27 Feb 2026 16:11:12 GMT

Hi,

[quote user=""]

NCS 2.9.0 (and I can't/won't update to 3.2.x as the nrfx4 update breaks all my code)

[/quote]

Ideally, to include all fixes up-to-date, it would be preferable to isolate this issue and test it on v3.2.x, as there has been several fixes and improvements wrt. raw mode since the release of v2.9.0.

Would it be possible that you perform these two scenarios on v3.2.1 isolated (ie. without any nrfx drivers etc), to see if the issues still persists?

Kind regards,

Håkon