nRF52840 / OpenThread: how to inject custom IEEE 802.15.4 RX frames into the native receive path?

[Igor Green]

Title: nRF52840 / OpenThread: how to inject custom IEEE 802.15.4 RX frames into the native receive path?

Hi,

I am working on a test setup around nRF52840, OpenThread, and Matter/Thread, and I would like to inject custom IEEE 802.15.4 frames into the normal receive path for testing purposes.

The goal is not just to parse frames externally, but to make the OpenThread stack receive them as if they had been received by the radio driver, preserving the normal buffer ownership, callbacks, metadata, and state machine behavior.

I am trying to understand the intended boundary for this kind of test injection.

Questions:

1. What is the recommended API/layer for injecting a custom raw IEEE 802.15.4 frame into the nRF 802.15.4/OpenThread receive path?

2. Is nrf_802154_received_raw() intended to be called by application/test code, or is it strictly an internal driver callback?

3. If using the nRF 802.15.4 driver, who owns the RX buffer passed to the receive callback, and what is the expected release/free path?

4. What metadata is required for a valid received frame? For example: RSSI, LQI, timestamp, channel, ACK/security state, or other driver-side fields.

5. Is there an existing Nordic-supported way to simulate radio RX frames for OpenThread/Matter testing without modifying the OpenThread stack itself?

6. If direct RX injection is not supported, what is the closest recommended approach for HIL testing or custom packet injection?

I am mainly looking for the correct architectural layer and ownership rules, not a shortcut that bypasses OpenThread behavior.

Target context:

• nRF52840

• IEEE 802.15.4 / Thread

• OpenThread

• Matter over Thread

• Zephyr / nRF Connect SDK style environment

Thanks.