5 GHz client mode: TX rate control permanently stuck at 6 Mbit/s legacy (RX unaffected, EHT/HE, related to #26/#36?)

[Festewerk]

Summary

In client mode on the 5 GHz band, TX rate control never scales above the 6 Mbit/s
legacy OFDM rate — not "halved" like #26, but effectively frozen at the base rate
regardless of channel, channel width, or DFS status. RX on the same link negotiates
EHT-MCS 11/12 (NSS 2) without issue. The same card performs full-speed TX on 6 GHz
(EHT-MCS 9, NSS 2, 320 MHz, ~3.8 Gbit/s PHY) and worked fine on 2.4 GHz, so the TX
path itself is not universally broken — this appears specific to 5 GHz.

Hardware / Software

• Card: TP-Link Archer TBE550E (MT7927), driver mt7925e via this DKMS
• DKMS version: 2.13 (confirmed reproducible; also present on 2.12)
• WM Firmware build: 20250606201037
• OS: Fedora 44 (KDE Plasma, Wayland), kernel 7.1.3-200.fc44.x86_64
• AP: TP-Link Omada EAP772 v2.0 (EU), standalone mode, WPA2/WPA3-Personal
• Distance ~3 m, signal -40…-46 dBm

Symptoms

• 5 GHz, ch 100 @ 160 MHz: rx 2401.9 Mbit/s (EHT-MCS 11, NSS 2) / tx stuck 6.0 Mbit/s
• 5 GHz, ch 36 @ 80 MHz: rx 1296.7 Mbit/s (EHT-MCS 12, NSS 2) / tx stuck 6.0 Mbit/s
• Real-world speedtest on 5 GHz: ~26 Mbit/s down, upload ~0-2 Mbit/s, jitter ~170 ms
• Same card, 6 GHz, 320 MHz: tx 3843.1 Mbit/s (EHT-MCS 9, NSS 2); speedtest ~825/958
  Mbit/s down/up — fully healthy
• 2.4 GHz: works normally

Not an RF / retry problem

iw dev <if> station dump during sustained 5 GHz traffic:

tx packets: 619814
tx retries: 14501 (~2.3%)
tx failed: 0

Zero failed frames, low retries — sent frames are acknowledged. Rate control simply
never attempts anything above the base rate on TX.

Confirmed AP-side is healthy

An Android phone (Wi-Fi 7 capable) on the same 5 GHz SSID/AP gets full speed with
no issues.

Workarounds attempted (all ineffective or unavailable)

• nmcli ... wifi.eht disable — not a recognized NM property in the installed
  NetworkManager version
• disable_eht=1 in /etc/wpa_supplicant/wpa_supplicant.conf — no measurable
  effect on throughput (NM manages the network block via D-Bus with its own
  wpa_supplicant instance lacking a ctrl_interface, so it's unclear whether the
  directive was ever applied per-network)
• iw dev <if> set bitrates he-mcs-5 0-11 → Invalid argument (-22)
• iw dev <if> set bitrates vht-mcs-5 2:0-9 → Operation not supported (-95)
• No userspace lever found to force non-EHT rates on this driver/firmware combo

Reproduction

1. Associate with a 5 GHz WPA2/WPA3-Personal BSS (tested both DFS and non-DFS
   channels, 80 and 160 MHz width).
2. Generate sustained upload traffic (speedtest, torrent seeding, etc.).
3. iw dev <if> link shows tx bitrate permanently at 6.0 Mbit/s; upload throughput
   collapses to near zero.

Possible relation to existing issues

This may be a more severe manifestation of the EHT path overhead in #26 (which
describes ~2x throughput reduction rather than a full stall), or related to the
"rate-control collapse to 6 Mbit/s" behavior noted in #36 for AP mode — but #36
is specifically about hotspot/AP mode, whereas this report is client mode
associating to an external AP.

Happy to test patches, debug builds, or provide additional logs/debugfs output.