topic Re: Random data in the association command - (with Murata NXP 88W8801 Typ2 2DS) in Wi-Fi® + Bluetooth® + 802.15.4

Random data in the association command - (with Murata NXP 88W8801 Typ2 2DS)

mjbcswitzerland — Tue, 28 Oct 2025 13:23:35 GMT

Hi All

After analysis of the HostCmd_CMD_802_11_ASSOCIATE command constructed when connecting to an access point as a station I conclude that there are some fields not set and random data is sent instead.

This concerns the global routine wlan_cmd_802_11_associate():

The first location is at

/* Set the listen interval */

passo->listen_interval = wlan_cpu_to_le16(pmpriv->listen_interval);

/* Set the beacon period */

passo->beacon_period = wlan_cpu_to_le16(pbss_desc->beacon_period);

Here the listening and beacon periods are inserted into the header but there is a further field called
t_u8 dtim_period;
which follows that is not filled out and so has a random value (depending on what was originally in the buffer used)

The second location is at

pss_tlv = (MrvlIEtypes_SsParamSet_t *)(void *)pos;
pss_tlv->header.type = wlan_cpu_to_le16(TLV_TYPE_CF);
pss_tlv->header.len = sizeof(pss_tlv->cf_ibss.cf_param_set);
pos += sizeof(pss_tlv->header) + pss_tlv->header.len;

Here is is seen that an entry of type TLV_TYPE_CF is inserted, with a fixed length of 6 bytes but the 6 bytes are not written and so have random values (depending on the original buffer content).
It looks as through the content of cf_param_set can be optionally filled by scan data if the CF_PARAM_SET ID is received. If it is not received it may be best to not insert the filed but it if has been received it may be correct to copy that data in here.

Comments are welcome.

Regards

Mark

Re: Random data in the association command - (with Murata NXP 88W8801 Typ2 2DS)

Christine_Li — Wed, 29 Oct 2025 03:01:07 GMT

Hi, @mjbcswitzerland

Are you using 88W8801 on RTOS or on Linux?

If on RTOS, can you please let me know your host platform name? Is it our I.MX RT series? What is your SDK version and IDE version?

If on Linux, can you please let me know your host platform name? Is it our I.MX 6,7,8,9 series? What 's your Linux kernel version, what is your Wi-Fi driver version?

Do you have logs for this? or How could you detect this issue?

Please help to share more background of this issue, then we can discuss further.

Thanks,

Christine.

Re: Random data in the association command - (with Murata NXP 88W8801 Typ2 2DS)

mjbcswitzerland — Wed, 29 Oct 2025 09:38:09 GMT

Hello Christine

I am working on an i.MX RT 1062 with the NXP WiFi library that is included in the MCUXpresso SDK.

MCUXpresso IDE v11.9.1 [Build 2170] [2024-04-19]

I don't know for sure what the SDK version number is but the project was originally installed on 26.8.2024. My SDk builder dash board however shows

SDK_2.14.0_EVK-MIMXRT1060

Below is a screen shot showing its mlan files and the first code issue where the dtim_period entry is not added to the command that it generates.; I see random data at the relevant byte locations in the command buffer that is created when looking at it with the debugger.

Regards

Mark

Re: Random data in the association command - (with Murata NXP 88W8801 Typ2 2DS)

Christine_Li — Mon, 03 Nov 2025 08:35:38 GMT

Hi, @mjbcswitzerland

I downloaded the same SDK version and checked what you mentioned.

The parameter is passed through IN HostCmd_DS_COMMAND *cmd.

Please see below:

HostCmd_DS_802_11_ASSOCIATE *passo = &cmd->params.associate;

If my understandings is not correct, please let me know.

Or you can provide your debugger screenshot, so that I can better understand your concerns.

Best regards,

Christine.

Re: Random data in the association command - (with Murata NXP 88W8801 Typ2 2DS)

mjbcswitzerland — Fri, 07 Nov 2025 20:56:48 GMT

Hi Christine

cmd

is an output buffer that is originally empty, and is filled during the routine and so cmd doesn't pass any values.

I'll send you debugger screen shots to show the issue the next time I am working with the debugger.

Regards

Mark

Regards

Mark

Re: Random data in the association command - (with Murata NXP 88W8801 Typ2 2DS)

Christine_Li — Sat, 08 Nov 2025 02:50:46 GMT

Hi, @mjbcswitzerland

Sure, please help to send the screenshot, so that we can better understand your meanings.

Best regards,

Christine.

Re: Random data in the association command - (with Murata NXP 88W8801 Typ2 2DS)

mjbcswitzerland — Mon, 10 Nov 2025 19:35:56 GMT

Hi Christine

Here are debug screen shots showing the issue.

1. I set a break point in
wlan_cmd_802_11_associate() [This function prepares command of association]
on the line
cmd->command = wlan_cpu_to_le16(HostCmd_CMD_802_11_ASSOCIATE);
and this is hit when the station connects to an access point.

2. I set the buffer (cmd) with an initial pattern so I can see which elements are filled out by the routine:

3. I let the function complete (it will now be ready to send the content) and check the content of the buffer again.

As seen in the buffer there are 7 bytes that haven't been changed (still with the initial value of 0x55).
(Note that some others at the beginning of the buffer also haven't changed but they are length values that are filled when the lowest level driver transmits the content)

4. I now repeat but set 0xAA as initial buffer pattern instead.
Then I allow the buffer to be filled out again:

This verifies that the 0x55/0xAA were not real values and confirms that the buffer is not fully written.

The first single byte is the location of dtim_period, which can be easily corrected by adding

passo->dtim_period = pbss_desc->dtim_period;

to the code.

The next 6 missing bytes are where the content of the union cf_ibss, of MrvlIEtypes_SsParamSet_t should be located. I didn't see where they come from so didn't try to correct the code.

Here is an example of a real connection attempt where the buffer starts with previously used content.
Before filling out:

After filling out:

It thus 'randomly' has whatever values were in the buffer at these location, which may either work of maybe not, depending on what they actually control and what values they happen to have. Code changes or changes in the order of the buffer use can of course lead to the original buffer content being different and thus potentially to changes in overall behavior.

I hope that I have been able to explain the bug adequately for it to be corrected in the project.

Regards

Mark

Re: Random data in the association command - (with Murata NXP 88W8801 Typ2 2DS)

Christine_Li — Tue, 11 Nov 2025 09:27:05 GMT

Hi， @mjbcswitzerland

From my personal understanding side, I think you are right.

But I need to report this to our internal expert SDK team help to double check and also I don't have permission to modify SDK directly.

Will update to you once get our internal team's any feedback.

Thanks for sharing this to us, it really can help us to improve our products.

Best regards,

Christine.

Re: Random data in the association command - (with Murata NXP 88W8801 Typ2 2DS)

Christine_Li — Thu, 13 Nov 2025 06:17:43 GMT

Hi, @mjbcswitzerland

Please see below for our internal team's feedback and confirm our understandings.

Uninitialized Fields in Association Command
During the construction of the HostCmd_CMD_802_11_ASSOCIATE command inside wlan_cmd_802_11_associate(), certain fields within the command structure are never explicitly initialized. These include:

dtim_period (1 byte) following listen_interval and beacon_period.
The 6-byte cf_param_set inside the TLV of type TLV_TYPE_CF.

Impact of Uninitialized Data
Because the command buffer is reused, these fields retain random leftover values from previous memory content. This can lead to:

Incorrect DTIM period being sent to the AP, potentially affecting power-save and multicast delivery.
Random CF parameter values being included in the TLV, which may cause unpredictable AP behavior or negotiation failures.

Your Verification

You confirmed this by initializing the buffer with known patterns (0x55 and 0xAA) before the function runs and observing unchanged bytes after execution.
Screenshots show these bytes remain as the initial pattern, proving they were never written by the code.

Your Expectation
These fields should not remain uninitialized. They should either:

Be populated with valid data from scan results (e.g., pbss_desc->dtim_period for DTIM).
Or explicitly zeroed out if no valid data is available.
For TLV_TYPE_CF, if CF parameters were not received during scan, the TLV should be skipped or filled with zeros.

Root Cause

The association command builder does not fully initialize the command structure.
Optional fields are added without proper handling for missing scan data.

To help narrow down the issue, please help to test using the latest release (v25.09.00) and confirm whether the same behavior is observed in that version.

Best regards

Christine.

Re: Random data in the association command - (with Murata NXP 88W8801 Typ2 2DS)

mjbcswitzerland — Thu, 13 Nov 2025 12:26:17 GMT

Hello Christine

Unfortunately I don't know where to find the version number that I am using and also not where to get access to new versions, like the referenced v25.09.00.

Do you know where is is located?

Regards

Mark

Re: Random data in the association command - (with Murata NXP 88W8801 Typ2 2DS)

Christine_Li — Sat, 15 Nov 2025 02:49:23 GMT

Hi， @mjbcswitzerland

1.Firstly, please help to confirm whether our understandings is sync/same with you.

2.I think you mentioned you are using: SDK_2.14.0_EVK-MIMXRT1060, but you are not very sure. So please firstly check what's the board in your hand, or take a picture to me. So that I can check for you. And also let me know whether have you done any hardware reworks on your board. In this way I can better understand which board you are using.

3.You can get our latest release from here:

https://mcuxpresso.nxp.com/select

Choose the board you are using.

Kindly remind:

We have MIMXRT1060-EVKB/MIMXRT1060-EVKC and EVK-MIMXRT1060

Please choose the correct one with the board in your hand.

If you are using: EVK-MIMXRT1060, then SDK_2.14.0 is the latest SDK release.

If you are usingMIMXRT1060-EVKB or MIMXRT1060-EVKC, the latest SDK release is: SDK 25.09 as my screenshot.

Best regards,

Christine.

Re: Random data in the association command - (with Murata NXP 88W8801 Typ2 2DS)

mjbcswitzerland — Sat, 15 Nov 2025 04:11:39 GMT

Hello Christine

I use an Embedded Artists board: https://www.embeddedartists.com/products/imx-rt1062-oem/
To use that I use the SDK_2.14.0 for the EVK-MIMXRT1060 with patches supplied by Embedded Artists so that it operates on their HW.
There are no patches for the WiFi part - that is simply taken from the SDK.

Therefore I believe that I already have the latest WiFi library code.

Regards

Mark

Re: Random data in the association command - (with Murata NXP 88W8801 Typ2 2DS)

Christine_Li — Mon, 17 Nov 2025 03:19:26 GMT

Hi, @mjbcswitzerland

Thanks for your reply, Ok, I understood.

Can you help to confirm whether our understandings is sync/same with you？

============

Uninitialized Fields in Association Command
During the construction of the HostCmd_CMD_802_11_ASSOCIATE command inside wlan_cmd_802_11_associate(), certain fields within the command structure are never explicitly initialized. These include:

dtim_period (1 byte) following listen_interval and beacon_period.
The 6-byte cf_param_set inside the TLV of type TLV_TYPE_CF.

Impact of Uninitialized Data
Because the command buffer is reused, these fields retain random leftover values from previous memory content. This can lead to:

Incorrect DTIM period being sent to the AP, potentially affecting power-save and multicast delivery.
Random CF parameter values being included in the TLV, which may cause unpredictable AP behavior or negotiation failures.

Your Verification

You confirmed this by initializing the buffer with known patterns (0x55 and 0xAA) before the function runs and observing unchanged bytes after execution.
Screenshots show these bytes remain as the initial pattern, proving they were never written by the code.

Your Expectation
These fields should not remain uninitialized. They should either:

Be populated with valid data from scan results (e.g., pbss_desc->dtim_period for DTIM).
Or explicitly zeroed out if no valid data is available.
For TLV_TYPE_CF, if CF parameters were not received during scan, the TLV should be skipped or filled with zeros.

Root Cause

The association command builder does not fully initialize the command structure.
Optional fields are added without proper handling for missing scan data.

===========

Best regards,

Christine.

Re: Random data in the association command - (with Murata NXP 88W8801 Typ2 2DS)

mjbcswitzerland — Mon, 17 Nov 2025 03:42:26 GMT

Hi Christine

I agree with the report - it is exactly as I understand (and see) the issue.

Regards

Mark

Re: Random data in the association command - (with Murata NXP 88W8801 Typ2 2DS)

Christine_Li — Thu, 20 Nov 2025 05:46:17 GMT

Hi, @mjbcswitzerland

Our colleague used his private account to log in and confirmed he can see the latest official release: 2.16.000 for EVK-MIMXRT1060.

Can you please help to try again on your side whether you can get the latest SDK version?

https://mcuxpresso.nxp.com/select

Then input EVK-MIMXRT1060 to search.

And at the same time, is it possible to get a patch with changes you make to confirm the reported issue verification? As you mentioned you received a patch from Embedded Artists.

Best regards,

Christine.

Re: Random data in the association command - (with Murata NXP 88W8801 Typ2 2DS)

Christine_Li — Fri, 21 Nov 2025 05:59:10 GMT

Hi, @mjbcswitzerland

Our colleague used his private account to log in and confirmed he can see the latest official release: 2.16.000 for EVK-MIMXRT1060.

Can you please help to try again on your side whether you can get the latest SDK version?

https://mcuxpresso.nxp.com/select

Then input EVK-MIMXRT1060 to search.

And at the same time, is it possible to get a patch with changes you make to confirm the reported issue verification? As you mentioned you received a patch from Embedded Artists.

Best regards,

Christine.

Re: Random data in the association command - (with Murata NXP 88W8801 Typ2 2DS)

mjbcswitzerland — Fri, 21 Nov 2025 12:50:51 GMT

Hello Christine

I have updated the SDK and can see various changes in the file mlan_join.c, however the uninitialised data exists still - there are no changes with regard to that.

Embedded Artists supplies a patch for their BSP (so that the board starts - eg. it can have a different HyperFlash that it needs to boot from) and this has nothing to do with the WiFi code. The WiFi code comes purely from the SDK.

Therefore this issue still exists in the most up-to-date WiFi code in the SDK.

Regards

Mark

Re: Random data in the association command - (with Murata NXP 88W8801 Typ2 2DS)

Christine_Li — Sat, 22 Nov 2025 02:27:11 GMT

Hi, @mjbcswitzerland

Our internal expert request to provide the patch.

I am not sure whether because they also have this board.

Would you mind share the patch to me?

You can send to my private working email so that protect the patch code.

I sent an email to you using my email address.

Best regards,

Christine.

Re: Random data in the association command - (with Murata NXP 88W8801 Typ2 2DS)

mjbcswitzerland — Sat, 22 Nov 2025 18:39:52 GMT

Christine

All patched SDKs for Embedded Artist i.MX / i.MX RT boards are available on-line here: http://imx.embeddedartists.com/

There are for the board that I use.

The download and installation guide is at https://developer.embeddedartists.com/docs-m2/get-started/imxrt_nxp/

Regards

Mark

Re: Random data in the association command - (with Murata NXP 88W8801 Typ2 2DS)

Christine_Li — Mon, 24 Nov 2025 02:53:22 GMT

Hi, @mjbcswitzerland

Thanks for your reply.

Then in the list, which patch are you using?

Is it the first one?

eaimxrt1062_16mb_sdk_2_15_000_2024-03-12.zip (release note)

Sorry, I need to forward exactly correct info to our internal team so that we can keep on one channel to discuss.

Best regards,

Christine.