Frame injection and channel switch possible broken on kernel 6.9.1 (6.9.1-arch1-1)

[ZerBea]

After an update to kernel 6.9.1 (AMD RYZEN systems running 6.9.1-arch1-1) I noticed that packet injection is broken on all drivers!
While monitor mode is still working as expected, frame injection failed.

hcxlabtool/hcxdumptool is not working any longer - none of my 5 test APs respond:

$ sudo hcxdumptool --rcascan=active -F
...
221 Packet(s) captured by kernel
0 Packet(s) dropped by kernel
Warning: no PROBERESPONSES received (frame injection may not work as expected)
Possible reasons:
 no AP in range
 frames are filtered out by BPF
 driver is broken
 driver does not support frame injection

After some more tests running monitor mode:
transmitting PROBEREQUEST frames -> completely broken
transmitting PROBERESPONSE frames -> completely broken
transmitting AUTHENTICATION frames -> completely broken
transmitting ASSOCIATION frames -> completely broken
transmitting REASSOCIATION frames -> completely broken
transmitting EAPOL frames -> completely broken
setting channel via NETLINK "NL80211_ATTR_WIPHY_FREQ" -> completely broken

That is not a single driver problem.
The entire MAC80211 system is affected.

Moving back to kernel 6.8 everything is working as expected.

BTW:
aireplay-ng doesn't work too:

$ sudo ./aireplay-ng --test wlp3s0f0u2
14:56:19  Trying broadcast probe requests...
14:56:21  No Answer...
14:56:21  Found 5 APs

and airodump-ng is not able to switch channel.

The bug has been reported to bugzilla.kernel.org

[ZerBea]

iw fails to set a channel, too:

set channel via iw:
$ sudo iw dev wlp5s0f4u2 set channel 11

double check that channel is 11:

$ iw dev
phy#1
	Interface wlp5s0f4u2
		ifindex 4
		wdev 0x100000001
		addr 74:da:38:12:0a:d3
		type monitor
		channel 11 (2462 MHz), width: 20 MHz (no HT), center1: 2462 MHz
		txpower 20.00 dBm
		multicast TXQ:
			qsz-byt	qsz-pkt	flows	drops	marks	overlmt	hashcol	tx-bytes	tx-packets
			0	0	0	0	0	0	0	0		0

According to iw the interface should be on channel 11, now.

record traffic (set display filter to show frequency)

$ tshark -i wlp5s0f4u2 -T fields -e "radiotap.channel.freq"
Capturing on 'wlp5s0f4u2'
2412
2412
2412
2412
2412
2412
2412

the interface is still on channel 1!

set channel via iw:
$ sudo iw dev wlp5s0f4u2 set channel 6

double check that interface is on channel 6:

$ iw dev
phy#1
	Interface wlp5s0f4u2
		ifindex 4
		wdev 0x100000001
		addr 74:da:38:12:0a:d3
		type monitor
		channel 6 (2437 MHz), width: 20 MHz (no HT), center1: 2437 MHz
		txpower 20.00 dBm
		multicast TXQ:
			qsz-byt	qsz-pkt	flows	drops	marks	overlmt	hashcol	tx-bytes	tx-packets
			0	0	0	0	0	0	0	0		0

record traffic (set display filter to show frequency)

$ tshark -i wlp5s0f4u2 -T fields -e "radiotap.channel.freq"
Capturing on 'wlp5s0f4u2'
2412
2412
2412
2412
2412
2412

the interface is still on channel 1!

[ZerBea]

Fixed since kernel 6.9.5:
https://bugzilla.kernel.org/show_bug.cgi?id=218884#c20