Keenetic Sprinter Seems not to respond to 802.11v BSS Transition Mgmt Queries

[Peter-Newman Messan]

I have a wifi system with a Sprinter (KN-3711) and Buddy 6 (KN-3411) both on Keenetic OS 5.0.8. I am testing a Zephyr RTOS - based device to verify experimental support for 802.11 roaming protocols (k, v, r).
So far, RRM Neighbor report requests from my device get responses, but BSS transition Mgmt queries get no responses. The queries are rate limited, min interval between two queries is 2 seconds. See sample logs from the device:

```
[08:31:01.486,000] <wrn> RT555/wifi_conn: signal (-68 dBm) is near / below threshold (-70 dBm), start roaming procedures
[08:31:01.486,000] <inf> RT555/wifi_conn: Signal level dropped, requesting roaming (deferred)
[08:31:01.486,000] <dbg> RT555/wpa_supp: wpa_printf_impl: Calling wpa_cli: wnm_bss_query, argc: 2
[08:31:01.486,000] <dbg> RT555/wpa_supp: wpa_printf_impl: argv[0]: wnm_bss_query
[08:31:01.486,000] <dbg> RT555/wpa_supp: wpa_printf_impl: argv[1]: 16
[08:31:01.487,000] <dbg> RT555/wpa_supp: wpa_printf_impl: wlan0: Control interface command 'WNM_BSS_QUERY 16'
[08:31:01.487,000] <dbg> RT555/wpa_supp: wpa_printf_impl: CTRL_IFACE: WNM_BSS_QUERY query_reason=16
[08:31:01.487,000] <inf> RT555/wpa_supp: WNM: Send BSS Transition Management Query to 52:ff:20:a8:57:4b query_reason=16
[08:31:01.487,000] <dbg> RT555/wpa_supp: wpa_printf_impl: wpa_supp: Send Action frame (freq=5240 MHz wait=0 ms no_cck=0)
[08:31:01.490,000] <dbg> RT555/wpa_supp: wpa_printf_impl: wpa_supp: Frame TX status event
[08:31:01.490,000] <dbg> RT555/wifi_supplicant: event_socket_handler: Passing message 16 to wpa_supplicant
[08:31:01.491,000] <dbg> RT555/wpa_supp: wpa_printf_impl: wlan0: Event TX_STATUS (16) received
[08:31:01.491,000] <dbg> RT555/wpa_supp: wpa_printf_impl: wlan0: EVENT_TX_STATUS dst=52:ff:20:a8:57:4b type=0 stype=13
[08:31:01.491,000] <inf> RT555/os: 0x300ab2d0 (supplicant_thread):      unused 3572     usage 4620 / 8192 (56 %)
[08:31:03.477,000] <dbg> RT555/wifi_supplicant: event_socket_handler: Passing message 24 to wpa_supplicant
[08:31:03.477,000] <dbg> RT555/wpa_supp: wpa_printf_impl: wlan0: Event SIGNAL_CHANGE (24) received
[08:31:03.478,000] <inf> RT555/wpa_supp: wlan0: CTRL-EVENT-SIGNAL-CHANGE above=1 signal=-67 noise=0 txrate=51600
[08:31:03.478,000] <dbg> RT555/wpa_supp: wpa_printf_impl: bgscan simple: signal level changed (above=1 current_signal=-67 current_noise=0 current_txrate=51600))
[08:31:03.478,000] <inf> RT555/os: 0x300ab2d0 (supplicant_thread):      unused 3572     usage 4620 / 8192 (56 %)
[08:31:03.478,000] <dbg> RT555/wpa_supp: wpa_printf_impl: Received len: 64, msg_len:64 - CTRL-EVENT-SIGNAL-CHANGE above=1 signal=-67 noise=0 txrate=51600->END
[08:31:03.479,000] <dbg> RT555/wpa_supp: wpa_printf_impl: wlan0: Control interface command 'SIGNAL_POLL'
[08:31:03.492,000] <wrn> RT555/wifi_conn: signal (-67 dBm) is near / below threshold (-70 dBm), start roaming procedures
[08:31:03.492,000] <inf> RT555/wifi_conn: Signal level dropped, requesting roaming (deferred)
[08:31:03.492,000] <dbg> RT555/wpa_supp: wpa_printf_impl: Calling wpa_cli: wnm_bss_query, argc: 2
[08:31:03.492,000] <dbg> RT555/wpa_supp: wpa_printf_impl: argv[0]: wnm_bss_query
[08:31:03.492,000] <dbg> RT555/wpa_supp: wpa_printf_impl: argv[1]: 16
[08:31:03.493,000] <dbg> RT555/wpa_supp: wpa_printf_impl: wlan0: Control interface command 'WNM_BSS_QUERY 16'
[08:31:03.493,000] <dbg> RT555/wpa_supp: wpa_printf_impl: CTRL_IFACE: WNM_BSS_QUERY query_reason=16
[08:31:03.493,000] <inf> RT555/wpa_supp: WNM: Send BSS Transition Management Query to 52:ff:20:a8:57:4b query_reason=16
[08:31:03.493,000] <dbg> RT555/wpa_supp: wpa_printf_impl: wpa_supp: Send Action frame (freq=5240 MHz wait=0 ms no_cck=0)
[08:31:03.496,000] <dbg> RT555/wpa_supp: wpa_printf_impl: wpa_supp: Frame TX status event
[08:31:03.496,000] <dbg> RT555/wifi_supplicant: event_socket_handler: Passing message 16 to wpa_supplicant
[08:31:03.497,000] <dbg> RT555/wpa_supp: wpa_printf_impl: wlan0: Event TX_STATUS (16) received
[08:31:03.497,000] <dbg> RT555/wpa_supp: wpa_printf_impl: wlan0: EVENT_TX_STATUS dst=52:ff:20:a8:57:4b type=0 stype=13
[08:31:03.497,000] <inf> RT555/os: 0x300ab2d0 (supplicant_thread):      unused 3572     usage 4620 / 8192 (56 %)

... no response ...

[08:31:05.498,000] <wrn> RT555/wifi_conn: signal (-68 dBm) is near / below threshold (-70 dBm), start roaming procedures
[08:31:05.498,000] <inf> RT555/wifi_conn: Signal level dropped, requesting roaming (deferred)
[08:31:05.499,000] <dbg> RT555/wpa_supp: wpa_printf_impl: Calling wpa_cli: wnm_bss_query, argc: 2
[08:31:05.499,000] <dbg> RT555/wpa_supp: wpa_printf_impl: argv[0]: wnm_bss_query
[08:31:05.499,000] <dbg> RT555/wpa_supp: wpa_printf_impl: argv[1]: 16
[08:31:05.499,000] <dbg> RT555/wpa_supp: wpa_printf_impl: wlan0: Control interface command 'WNM_BSS_QUERY 16'
[08:31:05.499,000] <dbg> RT555/wpa_supp: wpa_printf_impl: CTRL_IFACE: WNM_BSS_QUERY query_reason=16
[08:31:05.499,000] <inf> RT555/wpa_supp: WNM: Send BSS Transition Management Query to 52:ff:20:a8:57:4b query_reason=16
[08:31:05.500,000] <dbg> RT555/wpa_supp: wpa_printf_impl: wpa_supp: Send Action frame (freq=5240 MHz wait=0 ms no_cck=0)
[08:31:05.503,000] <dbg> RT555/wpa_supp: wpa_printf_impl: wpa_supp: Frame TX status event
[08:31:05.503,000] <dbg> RT555/wifi_supplicant: event_socket_handler: Passing message 16 to wpa_supplicant
[08:31:05.503,000] <dbg> RT555/wpa_supp: wpa_printf_impl: wlan0: Event TX_STATUS (16) received
[08:31:05.503,000] <dbg> RT555/wpa_supp: wpa_printf_impl: wlan0: EVENT_TX_STATUS dst=52:ff:20:a8:57:4b type=0 stype=13
[08:31:05.503,000] <inf> RT555/os: 0x300ab2d0 (supplicant_thread):      unused 3572     usage 4620 / 8192 (56 %)
 

... no response ...
```

To translate to human-readable terms query_reason=16 means "Low RSSI" and Event TX_STATUS (16) means event was tx'ed successfully.

The device is correctly listed with k and v support in the client list. I think it is strange that the controller does not respond to BTM queries at all. Any help would be appreciated.