That again calls for dumping WEXT into the bit-bucket. Because the scan command of NL80211/CFG80211 allows you to specify on which frequencies to scan. And wpa_supplicant has even a configuration entry to do that.