MT7925 (Netgear A9000 / MT7925U): UNI_CMD_CSI 0x4A acks but STA firmware emits no CSI reports

[Work Money]

Hi all,

I'm trying to get CSI (Channel State Information) out of a Netgear
Nighthawk A9000, which is an MT7925U (USB, WiFi 7, connac3). My end
goal is WiFi-sensing research.

What I've found so far:

- Chip: MT7925U, mt76 driver, station (STA) mode.
- Firmware: stock WIFI_RAM_CODE_MT7925_1_1.bin, build
  t-neptune-main-mt7925-2249 (MT7925_E1_ASIC_ROM_RAM_CE_2249,
  dated 2026-10-16). All code regions are encrypted (ENCRYPT
  feature flag, ~8.0 bits/byte entropy), so static RE of the
  blob isn't an option.
- Command path: I'm using the connac3 UNI_CMD_CSI_CTRL /
  UNI_EVENT_CSI_REPORT (both 0x4A) from the mt7996 SDK CSI patch.
- Behavior: sending CSI_START (tag 1) returns a success ack, but
  the firmware never emits any UNI_EVENT_CSI_REPORT events. This
  matches an earlier linux-wireless report [1].
- Kernel side is already built and tested: vendor netlink
  interface, ring buffer, debugfs, and event handlers. The only
  missing piece is the firmware actually emitting reports.

Questions:

1. Does the MT7925 STA firmware include a reachable CSI emission
   path, or is CSI reporting only wired up in AP builds
   (mt7996 / mt7981)?
2. If a handler exists behind the ack, is there a specific TLV
   parameter, sub-command, or precondition (monitor mode,
   bandwidth, sounding/beamforming enabled) that triggers it?
3. Is there an MT7925 firmware build or roadmap that enables CSI
   control in STA mode? Since the mt7996 SDK already implements
   0x4A, is a port to the MT7925 STA firmware feasible?
4. Any alternative route to per-subcarrier channel estimates on
   this chip -- ICAP / spectrum-scan mode, or RX descriptor
   fields -- that doesn't depend on the CSI command?

I'm happy to run tests, share full dmesg/mt76 debug logs, capture
traces, or try patches on real A9000 hardware. Thanks for any
pointers.

[1] https://ratatoskr.run/linux-wireless/2026/04/15794137