mac80211: update to version 6.18.7

This is based on Linux kernel 6.18.7.

This update contains the following upstream fixes:
f75b9d2c9f5b wifi: rtl8xxxu: Add USB ID 2001:3328 for D-Link AN3U rev. A1
401b10a72f5a wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1
c0d93d69e147 staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
e841d8ea7223 staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
bf323db1d883 staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing
b1497ea24639 wifi: ath10k: move recovery check logic into a new work
99fc0689a588 wifi: ath11k: restore register window after global reset
ab0554f51e5f wifi: ath12k: Fix MSDU buffer types handling in RX error path
d911fa97dab3 wifi: ath12k: fix VHT MCS assignment
ca2a33cee1ef wifi: ath12k: fix TX and RX MCS rate configurations in HE mode
18d4706956b7 wifi: ath11k: fix VHT MCS assignment
6b1a0da75932 wifi: ath11k: fix peer HE MCS assignment
d0a5b5d56438 wifi: ath12k: restore register window after global reset
1564c04afa92 wifi: iwlwifi: mld: add null check for kzalloc() in iwl_mld_send_proto_offload()
d0bb3db7b295 wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload()
36faecac7a2c wifi: ath12k: fix reusing m3 memory
4f93750fa588 wifi: ath12k: fix error handling in creating hardware group
41b623129175 wifi: ath12k: enforce vdev limit in ath12k_mac_vdev_create()
e442e820e953 wifi: ath12k: unassign arvif on scan vdev create failure
bcf44fe565bf wifi: rtw89: usb: use common error path for skbs in rtw89_usb_rx_handler()
87cc6fe79c3e wifi: rtw89: usb: fix leak in rtw89_usb_write_port()
c7ca777c5879 wifi: ath12k: Fix timeout error during beacon stats retrieval
51b823d7723f wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper()
c9d1c4152e6d wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
a6fb8785b179 wifi: mac80211: fix CMAC functions not handling errors
5ebf0fe7eaef wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
b8f34c1c5c4f wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx()
cbeca0b7ea20 wifi: mt76: mt7996: Remove unnecessary link_id checks in mt7996_tx
d582d0e988d6 wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks
d2d11298dfc3 wifi: mt76: mt7996: Remove useless check in mt7996_msdu_page_get_from_cache()
2cde732373a7 Revert "wifi: mt76: mt792x: improve monitor interface handling"
74bb080717a3 wifi: mt76: mt7996: fix max nss value when getting rx chainmask
95bb36f8d6b3 wifi: mt76: mt7996: fix implicit beamforming support for mt7992
ee94375d06b5 wifi: mt76: mt7996: fix several fields in mt7996_mcu_bss_basic_tlv()
d64e6f27260e wifi: mt76: mt7996: fix teardown command for an MLD peer
e5c42efeb162 wifi: mt76: mt7996: set link_valid field when initializing wcid
9a43ed9ab800 wifi: mt76: mt7996: fix MLD group index assignment
7d6cd8f51ad8 wifi: mt76: mt7996: fix MLO set key and group key issues
1a4b481a21ae wifi: mt76: mt7996: fix using wrong phy to start in mt7996_mac_restart()
b4b789d24319 wifi: mt76: mt7996: fix EMI rings for RRO
46f0648e261c wifi: mt76: mt7996: grab mt76 mutex in mt7996_mac_sta_event()
70656b45467c wifi: mt76: Move mt76_abort_scan out of mt76_reset_device()
c319967690d4 wifi: mt76: mt7996: skip deflink accounting for offchannel links
abdedd46dc58 wifi: mt76: mt7996: skip ieee80211_iter_keys() on scanning link remove
f4c57afff3b0 wifi: mt76: mt7996: Add missing locking in mt7996_mac_sta_rc_work()
4d42aba0ee49 mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()
ad26a7ef0488 wifi: ieee80211: correct FILS status codes
40257a2ef1bc wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU
c3ab9657866f wifi: cfg80211: stop radar detection in cfg80211_leave()
0283fac52b42 wifi: cfg80211: use cfg80211_leave() in iftype change
9c6f9b2a80ed wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load
f5323b43019d wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet
498e286941b9 wifi: mt76: Fix DTS power-limits on little endian systems
e5c129a05531 wifi: rtw88: limit indirect IO under powered off for RTL8822CS
90a15ff32464 wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()
7ea38152a289 wifi: cfg80211: sme: store capped length in __cfg80211_connect_result()
182a2786d248 wifi: mac80211: do not use old MBSSID elements
de5eb6b65e9f wifi: iwlwifi: Fix firmware version handling
a21704df4024 wifi: mac80211: Discard Beacon frames to non-broadcast address
e3c35177103e wifi: avoid kernel-infoleak from struct iw_point
b97be67dc06e wifi: mac80211: restore non-chanctx injection behaviour
1251bbdb8f5b wifi: mac80211_hwsim: fix typo in frequency notification

The following patches were applied upstream:
build/130-backports-move-__counted_by-to-compiler_types.h-head.patch patch [1]
build/999-kernel-6.12.64.patch [2]

[1]: https://github.com/openwrt/backports/commit/b63f79524e6f30e58692bc9ee57c6e6e0dd10de4
[2]: https://github.com/openwrt/backports/commit/ed8c176dfab1ae8962435576face472aaa7294c3

Link: https://github.com/openwrt/openwrt/pull/21711
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

19 files changed, 39 insertions, 122 deletions

diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
index 4267aa0e36..0beb264db1 100644
--- a/package/kernel/mac80211/Makefile
+++ b/package/kernel/mac80211/Makefile
@@ -10,13 +10,13 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=mac80211
 
-PKG_VERSION:=6.18
+PKG_VERSION:=6.18.7
 PKG_RELEASE:=1
 PKG_LICENSE:=GPL-2.0-only
 PKG_LICENSE_FILES:=COPYING
 
 PKG_SOURCE_URL:=https://github.com/openwrt/backports/releases/download/backports-v$(PKG_VERSION)
-PKG_HASH:=3bd5d84b1e56cf8addff0d1e4bcf06753c51feee88c4d7925fb7b67784529436
+PKG_HASH:=623e5cf46ca8e81fd413f4f465e2580a0143e24929f9c22ce1ba7c34f2872989
 
 PKG_SOURCE:=backports-$(PKG_VERSION).tar.zst
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(if $(BUILD_VARIANT),$(PKG_NAME)-$(BUILD_VARIANT)/)backports-$(PKG_VERSION)
diff --git a/package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch b/package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch
index 3569696b86..217901cc00 100644
--- a/package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch
+++ b/package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch
@@ -14,7 +14,7 @@ Signed-off-by: Sven Eckelmann <sven@open-mesh.com>
 
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -3586,6 +3586,16 @@ int ath10k_core_register(struct ath10k *
+@@ -3583,6 +3583,16 @@ int ath10k_core_register(struct ath10k *
  
  	queue_work(ar->workqueue, &ar->register_work);
  
diff --git a/package/kernel/mac80211/patches/ath10k/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch b/package/kernel/mac80211/patches/ath10k/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
index 4dffc7227f..8fab4c742e 100644
--- a/package/kernel/mac80211/patches/ath10k/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
+++ b/package/kernel/mac80211/patches/ath10k/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch
@@ -28,7 +28,7 @@ Forwarded: no
 
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -1052,6 +1052,40 @@ static inline int ath10k_vdev_delete_syn
+@@ -1051,6 +1051,40 @@ static inline int ath10k_vdev_delete_syn
  	return 0;
  }
  
@@ -69,7 +69,7 @@ Forwarded: no
  static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id)
  {
  	struct cfg80211_chan_def *chandef = NULL;
-@@ -1084,7 +1118,8 @@ static int ath10k_monitor_vdev_start(str
+@@ -1083,7 +1117,8 @@ static int ath10k_monitor_vdev_start(str
  	arg.channel.min_power = 0;
  	arg.channel.max_power = channel->max_power * 2;
  	arg.channel.max_reg_power = channel->max_reg_power * 2;
@@ -79,7 +79,7 @@ Forwarded: no
  
  	reinit_completion(&ar->vdev_setup_done);
  	reinit_completion(&ar->vdev_delete_done);
-@@ -1530,7 +1565,8 @@ static int ath10k_vdev_start_restart(str
+@@ -1529,7 +1564,8 @@ static int ath10k_vdev_start_restart(str
  	arg.channel.min_power = 0;
  	arg.channel.max_power = chandef->chan->max_power * 2;
  	arg.channel.max_reg_power = chandef->chan->max_reg_power * 2;
@@ -89,7 +89,7 @@ Forwarded: no
  
  	if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
  		arg.ssid = arvif->u.ap.ssid;
-@@ -3461,7 +3497,8 @@ static int ath10k_update_channel_list(st
+@@ -3460,7 +3496,8 @@ static int ath10k_update_channel_list(st
  			ch->min_power = 0;
  			ch->max_power = channel->max_power * 2;
  			ch->max_reg_power = channel->max_reg_power * 2;
diff --git a/package/kernel/mac80211/patches/ath10k/984-ath10k-Try-to-get-mac-address-from-dts.patch b/package/kernel/mac80211/patches/ath10k/984-ath10k-Try-to-get-mac-address-from-dts.patch
index d34826afc8..5f59ac20ff 100644
--- a/package/kernel/mac80211/patches/ath10k/984-ath10k-Try-to-get-mac-address-from-dts.patch
+++ b/package/kernel/mac80211/patches/ath10k/984-ath10k-Try-to-get-mac-address-from-dts.patch
@@ -18,7 +18,7 @@ Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
 
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -11,6 +11,7 @@
+@@ -10,6 +10,7 @@
  #include <linux/module.h>
  #include <linux/firmware.h>
  #include <linux/of.h>
@@ -26,7 +26,7 @@ Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
  #include <linux/property.h>
  #include <linux/dmi.h>
  #include <linux/ctype.h>
-@@ -3458,6 +3459,8 @@ static int ath10k_core_probe_fw(struct a
+@@ -3455,6 +3456,8 @@ static int ath10k_core_probe_fw(struct a
  
  	device_get_mac_address(ar->dev, ar->mac_addr);
  
diff --git a/package/kernel/mac80211/patches/ath11k/100-wifi-ath11k-use-unique-QRTR-instance-ID.patch b/package/kernel/mac80211/patches/ath11k/100-wifi-ath11k-use-unique-QRTR-instance-ID.patch
index c2f3f737e6..87f8000ec6 100644
--- a/package/kernel/mac80211/patches/ath11k/100-wifi-ath11k-use-unique-QRTR-instance-ID.patch
+++ b/package/kernel/mac80211/patches/ath11k/100-wifi-ath11k-use-unique-QRTR-instance-ID.patch
@@ -140,7 +140,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
  int ath11k_mhi_register(struct ath11k_pci *ar_pci);
 --- a/drivers/net/wireless/ath/ath11k/pci.c
 +++ b/drivers/net/wireless/ath/ath11k/pci.c
-@@ -376,13 +376,20 @@ static void ath11k_pci_sw_reset(struct a
+@@ -394,13 +394,20 @@ static void ath11k_pci_sw_reset(struct a
  static void ath11k_pci_init_qmi_ce_config(struct ath11k_base *ab)
  {
  	struct ath11k_qmi_ce_cfg *cfg = &ab->qmi.ce_cfg;
diff --git a/package/kernel/mac80211/patches/ath11k/924-wifi-ath11k-add-multipd-support-for-QCN6122.patch b/package/kernel/mac80211/patches/ath11k/924-wifi-ath11k-add-multipd-support-for-QCN6122.patch
index fe5e962c9f..d8a7191c82 100644
--- a/package/kernel/mac80211/patches/ath11k/924-wifi-ath11k-add-multipd-support-for-QCN6122.patch
+++ b/package/kernel/mac80211/patches/ath11k/924-wifi-ath11k-add-multipd-support-for-QCN6122.patch
@@ -99,7 +99,7 @@ Signed-off-by: George Moussalem <george.moussalem@outlook.com>
  	struct ath11k_targ_cap target_caps;
 --- a/drivers/net/wireless/ath/ath11k/pci.c
 +++ b/drivers/net/wireless/ath/ath11k/pci.c
-@@ -391,6 +391,8 @@ static void ath11k_pci_init_qmi_ce_confi
+@@ -409,6 +409,8 @@ static void ath11k_pci_init_qmi_ce_confi
  	} else
  		ab->qmi.service_ins_id = ab->hw_params.qmi_service_ins_id;
  
diff --git a/package/kernel/mac80211/patches/ath12k/100-ath12k-prevent-ltssm-startup-crash.patch b/package/kernel/mac80211/patches/ath12k/100-ath12k-prevent-ltssm-startup-crash.patch
index 2209878b3c..a98c82f818 100644
--- a/package/kernel/mac80211/patches/ath12k/100-ath12k-prevent-ltssm-startup-crash.patch
+++ b/package/kernel/mac80211/patches/ath12k/100-ath12k-prevent-ltssm-startup-crash.patch
@@ -5,7 +5,7 @@ But have issues on BPI-Rx boards.
 
 --- a/drivers/net/wireless/ath/ath12k/pci.c
 +++ b/drivers/net/wireless/ath/ath12k/pci.c
-@@ -279,6 +279,9 @@ static void ath12k_pci_enable_ltssm(stru
+@@ -297,6 +297,9 @@ static void ath12k_pci_enable_ltssm(stru
  	u32 val;
  	int i;
  
diff --git a/package/kernel/mac80211/patches/ath12k/102-wifi-ath12k-limit-WMI_SCAN_CHAN_LIST_CMDID-arg.patch b/package/kernel/mac80211/patches/ath12k/102-wifi-ath12k-limit-WMI_SCAN_CHAN_LIST_CMDID-arg.patch
index 3cf00dc17a..36d7d681b8 100644
--- a/package/kernel/mac80211/patches/ath12k/102-wifi-ath12k-limit-WMI_SCAN_CHAN_LIST_CMDID-arg.patch
+++ b/package/kernel/mac80211/patches/ath12k/102-wifi-ath12k-limit-WMI_SCAN_CHAN_LIST_CMDID-arg.patch
@@ -130,7 +130,7 @@ Best regards,
 
 --- a/drivers/net/wireless/ath/ath12k/wmi.c
 +++ b/drivers/net/wireless/ath/ath12k/wmi.c
-@@ -2891,6 +2891,9 @@ int ath12k_wmi_send_scan_chan_list_cmd(s
+@@ -2894,6 +2894,9 @@ int ath12k_wmi_send_scan_chan_list_cmd(s
  		max_chan_limit = (wmi->wmi_ab->max_msg_len[ar->pdev_idx] - len) /
  			sizeof(*chan_info);
  
diff --git a/package/kernel/mac80211/patches/ath12k/103-wifi-ath12k-fix-5GHz-operation-on-wideband-QCN.patch b/package/kernel/mac80211/patches/ath12k/103-wifi-ath12k-fix-5GHz-operation-on-wideband-QCN.patch
index ed47f13229..14f6fbb35e 100644
--- a/package/kernel/mac80211/patches/ath12k/103-wifi-ath12k-fix-5GHz-operation-on-wideband-QCN.patch
+++ b/package/kernel/mac80211/patches/ath12k/103-wifi-ath12k-fix-5GHz-operation-on-wideband-QCN.patch
@@ -124,7 +124,7 @@ Best regards,
 
 --- a/drivers/net/wireless/ath/ath12k/mac.c
 +++ b/drivers/net/wireless/ath/ath12k/mac.c
-@@ -7723,9 +7723,7 @@ static void ath12k_mac_setup_ht_vht_cap(
+@@ -7724,9 +7724,7 @@ static void ath12k_mac_setup_ht_vht_cap(
  						    rate_cap_rx_chainmask);
  	}
  
diff --git a/package/kernel/mac80211/patches/ath12k/200-Revert-wifi-ath12k-convert-tasklet-to-BH-workqueue-f.patch b/package/kernel/mac80211/patches/ath12k/200-Revert-wifi-ath12k-convert-tasklet-to-BH-workqueue-f.patch
index 9f435f92df..6df26e0ddd 100644
--- a/package/kernel/mac80211/patches/ath12k/200-Revert-wifi-ath12k-convert-tasklet-to-BH-workqueue-f.patch
+++ b/package/kernel/mac80211/patches/ath12k/200-Revert-wifi-ath12k-convert-tasklet-to-BH-workqueue-f.patch
@@ -23,7 +23,7 @@ This reverts commit cdad737160571a98cc4933a62c9f2728e965ab27.
  	struct ath12k_ce_ring *status_ring;
 --- a/drivers/net/wireless/ath/ath12k/pci.c
 +++ b/drivers/net/wireless/ath/ath12k/pci.c
-@@ -430,9 +430,9 @@ static void ath12k_pci_sync_ce_irqs(stru
+@@ -448,9 +448,9 @@ static void ath12k_pci_sync_ce_irqs(stru
  	}
  }
  
@@ -35,7 +35,7 @@ This reverts commit cdad737160571a98cc4933a62c9f2728e965ab27.
  	int irq_idx = ATH12K_PCI_IRQ_CE0_OFFSET + ce_pipe->pipe_num;
  
  	ath12k_ce_per_engine_service(ce_pipe->ab, ce_pipe->pipe_num);
-@@ -454,7 +454,7 @@ static irqreturn_t ath12k_pci_ce_interru
+@@ -472,7 +472,7 @@ static irqreturn_t ath12k_pci_ce_interru
  
  	disable_irq_nosync(ab->irq_num[irq_idx]);
  
@@ -44,7 +44,7 @@ This reverts commit cdad737160571a98cc4933a62c9f2728e965ab27.
  
  	return IRQ_HANDLED;
  }
-@@ -684,7 +684,7 @@ static int ath12k_pci_config_irq(struct
+@@ -702,7 +702,7 @@ static int ath12k_pci_config_irq(struct
  
  		irq_idx = ATH12K_PCI_IRQ_CE0_OFFSET + i;
  
@@ -53,7 +53,7 @@ This reverts commit cdad737160571a98cc4933a62c9f2728e965ab27.
  
  		ret = request_irq(irq, ath12k_pci_ce_interrupt_handler,
  				  ab_pci->irq_flags, irq_name[irq_idx],
-@@ -967,7 +967,7 @@ static void ath12k_pci_aspm_restore(stru
+@@ -985,7 +985,7 @@ static void ath12k_pci_aspm_restore(stru
  						   PCI_EXP_LNKCTL_ASPMC);
  }
  
@@ -62,7 +62,7 @@ This reverts commit cdad737160571a98cc4933a62c9f2728e965ab27.
  {
  	int i;
  
-@@ -977,7 +977,7 @@ static void ath12k_pci_cancel_workqueue(
+@@ -995,7 +995,7 @@ static void ath12k_pci_cancel_workqueue(
  		if (ath12k_ce_get_attr_flags(ab, i) & CE_ATTR_DIS_INTR)
  			continue;
  
@@ -71,7 +71,7 @@ This reverts commit cdad737160571a98cc4933a62c9f2728e965ab27.
  	}
  }
  
-@@ -985,7 +985,7 @@ static void ath12k_pci_ce_irq_disable_sy
+@@ -1003,7 +1003,7 @@ static void ath12k_pci_ce_irq_disable_sy
  {
  	ath12k_pci_ce_irqs_disable(ab);
  	ath12k_pci_sync_ce_irqs(ab);
diff --git a/package/kernel/mac80211/patches/build/130-backports-move-__counted_by-to-compiler_types.h-head.patch b/package/kernel/mac80211/patches/build/130-backports-move-__counted_by-to-compiler_types.h-head.patch
deleted file mode 100644
index ca821dc6e3..0000000000
--- a/package/kernel/mac80211/patches/build/130-backports-move-__counted_by-to-compiler_types.h-head.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From b63f79524e6f30e58692bc9ee57c6e6e0dd10de4 Mon Sep 17 00:00:00 2001
-From: Christian Marangi <ansuelsmth@gmail.com>
-Date: Wed, 10 Dec 2025 22:37:03 +0100
-Subject: [PATCH] backports: move __counted_by to compiler_types.h header
-
-Port f06e108a3dc5 ("Compiler Attributes: disable __counted_by for clang
-< 19.1.3") changes to align with new kernel version that moved the
-__counted_by to a new header file.
-
-Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
----
- .../linux/compiler_attributes.h               | 15 ------------
- .../backport-include/linux/compiler_types.h   | 23 +++++++++++++++++++
- 2 files changed, 23 insertions(+), 15 deletions(-)
- create mode 100644 backport-include/linux/compiler_types.h
-
---- a/backport-include/linux/compiler_attributes.h
-+++ b/backport-include/linux/compiler_attributes.h
-@@ -31,19 +31,4 @@
- #endif
- #endif /* fallthrough */
- 
--#ifndef __counted_by
--/*
-- * Optional: only supported since gcc >= 14
-- * Optional: only supported since clang >= 17
-- *
-- *   gcc: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108896
-- * clang: https://reviews.llvm.org/D148381
-- */
--#if __has_attribute(__element_count__)
--# define __counted_by(member)		__attribute__((__element_count__(#member)))
--#else
--# define __counted_by(member)
--#endif
--#endif
--
- #endif /* _BACKPORTS_LINUX_COMPILER_ATTRIBUTES_H */
---- /dev/null
-+++ b/backport-include/linux/compiler_types.h
-@@ -0,0 +1,23 @@
-+#ifndef _BACKPORTS_LINUX_COMPILER_TYPES_H
-+#define _BACKPORTS_LINUX_COMPILER_TYPES_H 1
-+
-+#if LINUX_VERSION_IS_GEQ(6,12,1)
-+#include_next <linux/compiler_types.h>
-+#endif
-+
-+#ifndef __counted_by
-+/*
-+ * Optional: only supported since gcc >= 14
-+ * Optional: only supported since clang >= 17
-+ *
-+ *   gcc: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108896
-+ * clang: https://reviews.llvm.org/D148381
-+ */
-+#if __has_attribute(__element_count__)
-+# define __counted_by(member)		__attribute__((__element_count__(#member)))
-+#else
-+# define __counted_by(member)
-+#endif
-+#endif
-+
-+#endif /* _BACKPORTS_LINUX_COMPILER_TYPES_H */
diff --git a/package/kernel/mac80211/patches/build/210-wireless_netns_local_backport.patch b/package/kernel/mac80211/patches/build/210-wireless_netns_local_backport.patch
index 222422102e..428d8df0f1 100644
--- a/package/kernel/mac80211/patches/build/210-wireless_netns_local_backport.patch
+++ b/package/kernel/mac80211/patches/build/210-wireless_netns_local_backport.patch
@@ -40,7 +40,7 @@
  		}
  
  		return err;
-@@ -1549,7 +1565,11 @@ static int cfg80211_netdev_notifier_call
+@@ -1550,7 +1566,11 @@ static int cfg80211_netdev_notifier_call
  		SET_NETDEV_DEVTYPE(dev, &wiphy_type);
  		wdev->netdev = dev;
  		/* can only change netns with wiphy */
diff --git a/package/kernel/mac80211/patches/build/999-kernel-6.12.64.patch b/package/kernel/mac80211/patches/build/999-kernel-6.12.64.patch
deleted file mode 100644
index 0b47fc63e5..0000000000
--- a/package/kernel/mac80211/patches/build/999-kernel-6.12.64.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-diff --git a/backport-include/linux/hrtimer.h b/backport-include/linux/hrtimer.h
-index 3c351922c81d..d865dbf42e9b 100644
---- a/backport-include/linux/hrtimer.h
-+++ b/backport-include/linux/hrtimer.h
-@@ -17,12 +17,14 @@ static inline enum hrtimer_restart hrtimer_dummy_timeout(struct hrtimer *unused)
- 	return HRTIMER_NORESTART;
- }
- 
-+#if LINUX_VERSION_IS_LESS(6,12,64)
- static inline void
- hrtimer_update_function(struct hrtimer *timer,
- 			enum hrtimer_restart (*function)(struct hrtimer *))
- {
- 	timer->function = function;
- }
-+#endif /* < 6.12.64 */
- 
- static inline void
- hrtimer_setup(struct hrtimer *timer, enum hrtimer_restart (*function)(struct hrtimer *),
diff --git a/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch b/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
index 98c1317ad4..f9956ea05c 100644
--- a/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
+++ b/package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch
@@ -9,7 +9,7 @@ Used for AP+STA support in OpenWrt - preserve AP mode keys across STA reconnect
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -1882,12 +1882,6 @@ static int ieee80211_stop_ap(struct wiph
+@@ -1872,12 +1872,6 @@ static int ieee80211_stop_ap(struct wiph
  
  	__sta_info_flush(sdata, true, link_id, NULL);
  
diff --git a/package/kernel/mac80211/patches/subsys/210-ap_scan.patch b/package/kernel/mac80211/patches/subsys/210-ap_scan.patch
index 419f71cda9..6289334b56 100644
--- a/package/kernel/mac80211/patches/subsys/210-ap_scan.patch
+++ b/package/kernel/mac80211/patches/subsys/210-ap_scan.patch
@@ -8,7 +8,7 @@ Subject: [PATCH] mac80211: allow scans in access point mode (for site survey)
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -3131,6 +3131,8 @@ static int ieee80211_scan(struct wiphy *
+@@ -3121,6 +3121,8 @@ static int ieee80211_scan(struct wiphy *
  		 */
  		fallthrough;
  	case NL80211_IFTYPE_AP:
diff --git a/package/kernel/mac80211/patches/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patch b/package/kernel/mac80211/patches/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patch
index a61192b651..e553f11080 100644
--- a/package/kernel/mac80211/patches/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patch
+++ b/package/kernel/mac80211/patches/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patch
@@ -23,7 +23,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4084,7 +4084,7 @@ struct ieee80211_txq *ieee80211_next_txq
+@@ -4086,7 +4086,7 @@ struct ieee80211_txq *ieee80211_next_txq
  
  		if (deficit < 0)
  			sta->airtime[txqi->txq.ac].deficit +=
@@ -32,7 +32,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  		if (deficit < 0 || !aql_check) {
  			list_move_tail(&txqi->schedule_order,
-@@ -4229,7 +4229,8 @@ bool ieee80211_txq_may_transmit(struct i
+@@ -4231,7 +4231,8 @@ bool ieee80211_txq_may_transmit(struct i
  		}
  		sta = container_of(iter->txq.sta, struct sta_info, sta);
  		if (ieee80211_sta_deficit(sta, ac) < 0)
@@ -42,7 +42,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		list_move_tail(&iter->schedule_order, &local->active_txqs[ac]);
  	}
  
-@@ -4237,7 +4238,7 @@ bool ieee80211_txq_may_transmit(struct i
+@@ -4239,7 +4240,7 @@ bool ieee80211_txq_may_transmit(struct i
  	if (sta->airtime[ac].deficit >= 0)
  		goto out;
  
diff --git a/package/kernel/mac80211/patches/subsys/320-mac80211-add-AQL-support-for-broadcast-packets.patch b/package/kernel/mac80211/patches/subsys/320-mac80211-add-AQL-support-for-broadcast-packets.patch
index 7f57e9d5b8..f9e917467d 100644
--- a/package/kernel/mac80211/patches/subsys/320-mac80211-add-AQL-support-for-broadcast-packets.patch
+++ b/package/kernel/mac80211/patches/subsys/320-mac80211-add-AQL-support-for-broadcast-packets.patch
@@ -127,7 +127,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  			atomic_add(tx_airtime,
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -2554,7 +2554,7 @@ static u16 ieee80211_store_ack_skb(struc
+@@ -2556,7 +2556,7 @@ static u16 ieee80211_store_ack_skb(struc
  
  		spin_lock_irqsave(&local->ack_status_lock, flags);
  		id = idr_alloc(&local->ack_status_frames, ack_skb,
@@ -136,7 +136,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		spin_unlock_irqrestore(&local->ack_status_lock, flags);
  
  		if (id >= 0) {
-@@ -3985,20 +3985,20 @@ begin:
+@@ -3987,20 +3987,20 @@ begin:
  encap_out:
  	info->control.vif = vif;
  
@@ -167,7 +167,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	}
  
  	return skb;
-@@ -4050,6 +4050,7 @@ struct ieee80211_txq *ieee80211_next_txq
+@@ -4052,6 +4052,7 @@ struct ieee80211_txq *ieee80211_next_txq
  	struct ieee80211_txq *ret = NULL;
  	struct txq_info *txqi = NULL, *head = NULL;
  	bool found_eligible_txq = false;
@@ -175,7 +175,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	spin_lock_bh(&local->active_txq_lock[ac]);
  
-@@ -4073,26 +4074,26 @@ struct ieee80211_txq *ieee80211_next_txq
+@@ -4075,26 +4076,26 @@ struct ieee80211_txq *ieee80211_next_txq
  	if (!head)
  		head = txqi;
  
@@ -214,7 +214,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (txqi->schedule_round == local->schedule_round[ac])
  		goto out;
  
-@@ -4159,7 +4160,8 @@ bool ieee80211_txq_airtime_check(struct
+@@ -4161,7 +4162,8 @@ bool ieee80211_txq_airtime_check(struct
  		return true;
  
  	if (!txq->sta)
@@ -224,7 +224,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	if (unlikely(txq->tid == IEEE80211_NUM_TIDS))
  		return true;
-@@ -4208,15 +4210,15 @@ bool ieee80211_txq_may_transmit(struct i
+@@ -4210,15 +4212,15 @@ bool ieee80211_txq_may_transmit(struct i
  
  	spin_lock_bh(&local->active_txq_lock[ac]);
  
diff --git a/package/kernel/mac80211/patches/subsys/350-mac80211-allow-scanning-while-on-radar-channel.patch b/package/kernel/mac80211/patches/subsys/350-mac80211-allow-scanning-while-on-radar-channel.patch
index 078bfc0c19..c4fd726b81 100644
--- a/package/kernel/mac80211/patches/subsys/350-mac80211-allow-scanning-while-on-radar-channel.patch
+++ b/package/kernel/mac80211/patches/subsys/350-mac80211-allow-scanning-while-on-radar-channel.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -3825,6 +3825,27 @@ static bool ieee80211_is_scan_ongoing(st
+@@ -3815,6 +3815,27 @@ static bool ieee80211_is_scan_ongoing(st
  	return false;
  }
  
@@ -28,7 +28,7 @@
  static int ieee80211_start_radar_detection(struct wiphy *wiphy,
  					   struct net_device *dev,
  					   struct cfg80211_chan_def *chandef,
-@@ -3838,7 +3859,7 @@ static int ieee80211_start_radar_detecti
+@@ -3828,7 +3849,7 @@ static int ieee80211_start_radar_detecti
  
  	lockdep_assert_wiphy(local->hw.wiphy);
  
@@ -37,7 +37,7 @@
  		return -EBUSY;
  
  	link_data = sdata_dereference(sdata->link[link_id], sdata);
-@@ -4330,7 +4351,7 @@ __ieee80211_channel_switch(struct wiphy
+@@ -4320,7 +4341,7 @@ __ieee80211_channel_switch(struct wiphy
  
  	lockdep_assert_wiphy(local->hw.wiphy);
  
@@ -387,7 +387,7 @@
   * the suspend->resume cycle. Since we can't check each caller
 --- a/net/wireless/util.c
 +++ b/net/wireless/util.c
-@@ -2964,6 +2964,9 @@ bool cfg80211_radio_chandef_valid(const
+@@ -2943,6 +2943,9 @@ bool cfg80211_radio_chandef_valid(const
  {
  	u32 freq, width;
  
diff --git a/package/kernel/mac80211/patches/subsys/370-wifi-mac80211-add-MLO-support-to-ieee80211_probe_cli.patch b/package/kernel/mac80211/patches/subsys/370-wifi-mac80211-add-MLO-support-to-ieee80211_probe_cli.patch
index dbb239ebe5..f6538694c4 100644
--- a/package/kernel/mac80211/patches/subsys/370-wifi-mac80211-add-MLO-support-to-ieee80211_probe_cli.patch
+++ b/package/kernel/mac80211/patches/subsys/370-wifi-mac80211-add-MLO-support-to-ieee80211_probe_cli.patch
@@ -9,7 +9,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -4594,7 +4594,9 @@ static int ieee80211_probe_client(struct
+@@ -4584,7 +4584,9 @@ static int ieee80211_probe_client(struct
  	struct ieee80211_tx_info *info;
  	struct sta_info *sta;
  	struct ieee80211_chanctx_conf *chanctx_conf;
@@ -19,7 +19,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	int ret;
  
  	/* the lock is needed to assign the cookie later */
-@@ -4609,7 +4611,23 @@ static int ieee80211_probe_client(struct
+@@ -4599,7 +4601,23 @@ static int ieee80211_probe_client(struct
  
  	qos = sta->sta.wme;
  
@@ -44,7 +44,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (WARN_ON(!chanctx_conf)) {
  		ret = -EINVAL;
  		goto unlock;
-@@ -4641,14 +4659,15 @@ static int ieee80211_probe_client(struct
+@@ -4631,14 +4649,15 @@ static int ieee80211_probe_client(struct
  	nullfunc->frame_control = fc;
  	nullfunc->duration_id = 0;
  	memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);