diff --git a/mxm_wifiex/wlan_src/Makefile b/mxm_wifiex/wlan_src/Makefile
index 35548df..3ec5308 100644
--- a/mxm_wifiex/wlan_src/Makefile
+++ b/mxm_wifiex/wlan_src/Makefile
@@ -135,6 +135,25 @@ ifneq ($(ANDROID_PRODUCT_OUT),)
 ccflags-y += -DIMX_ANDROID
 ccflags-y += -Wno-implicit-fallthrough
 CONFIG_ANDROID_KERNEL=y
+#Automatically determine Android version from build information to streamline BSP code handling.
+ifeq ($(ANDROID_PRODUCT_OUT),1)
+ccflags-y += -DANDROID_SDK_VERSION=$(ANDROID_SDK_VERSION)
+else
+include $(ANDROID_BUILD_TOP)/build/make/core/build_id.mk
+ifeq ($(shell echo "$(BUILD_ID)" | cut -c1),R)
+      ccflags-y += -DANDROID_SDK_VERSION=30
+else ifeq ($(shell echo "$(BUILD_ID)" | cut -c1),S)
+      ccflags-y += -DANDROID_SDK_VERSION=31
+else ifeq ($(shell echo "$(BUILD_ID)" | cut -c1),T)
+      ccflags-y += -DANDROID_SDK_VERSION=33
+else ifeq ($(shell echo "$(BUILD_ID)" | cut -c1),U)
+      ccflags-y += -DANDROID_SDK_VERSION=34
+else
+    # Default optimization or actions
+      ANDROID_SDK_VERSION := 0
+      ccflags-y += -DANDROID_SDK_VERSION
+endif
+endif
 endif
 endif
 
@@ -148,7 +167,7 @@ APPDIR= $(shell if test -d "mapp"; then echo mapp; fi)
 #############################################################################
 
 	ccflags-y += -I$(KERNELDIR)/include
-	ccflags-y += -DMLAN_RELEASE_VERSION='"437.p3"'
+	ccflags-y += -DMLAN_RELEASE_VERSION='"437.p8"'
 
 	ccflags-y += -DFPNUM='"92"'
 
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_cmdevt.c b/mxm_wifiex/wlan_src/mlan/mlan_cmdevt.c
index 428f412..804ece2 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_cmdevt.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_cmdevt.c
@@ -740,9 +740,7 @@ static t_u8 *wlan_strchr(t_u8 *s, int c)
 	while (*pos != '\0') {
 		if (*pos == (t_u8)c)
 			return pos;
-		if (!wlan_secure_add(pos, 1, pos, TYPE_PTR)) {
-			PRINTM(MERROR, "pos is invalid\n");
-		}
+		pos++;
 	}
 	return MNULL;
 }
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_decl.h b/mxm_wifiex/wlan_src/mlan/mlan_decl.h
index d392e09..3386669 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_decl.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_decl.h
@@ -847,6 +847,7 @@ typedef enum _mlan_event_id {
 	MLAN_EVENT_ID_SSU_DUMP_FILE = 0x00000039,
 #endif /* SSU_SUPPORT */
 	MLAN_EVENT_ID_CSI = 0x00000040,
+	MLAN_EVENT_ID_FW_TX_BULK_STATUS = 0x00000043,
 	/* Event generated by MLAN driver (MSB=1) */
 	MLAN_EVENT_ID_DRV_CONNECTED = 0x80000001,
 	MLAN_EVENT_ID_DRV_DEFER_HANDLING = 0x80000002,
@@ -2730,6 +2731,8 @@ typedef struct _mlan_device {
 	t_u8 passive_to_active_scan;
 	/** uap max supported station per chip */
 	t_u8 uap_max_sta;
+	/** wacp mode */
+	t_u8 wacp_mode;
 	/** drv mode */
 	t_u32 drv_mode;
 	/** dfs w53 cfg */
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_event_ids.h b/mxm_wifiex/wlan_src/mlan/mlan_event_ids.h
index cfbd78e..14d5184 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_event_ids.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_event_ids.h
@@ -206,5 +206,8 @@ ENUM_ELEMENT(EVENT_DUMMY_HOST_WAKEUP_SIGNAL, 0x0001),
 	ENUM_ELEMENT(EVENT_IMD3_CAL_START, 0x00A0),
 	ENUM_ELEMENT(EVENT_IMD3_CAL_END, 0x00A1),
 
+	/** Event ID: Bulk Tx status */
+	ENUM_ELEMENT(EVENT_TX_STATUS_BULK_REPORT, 0x00A2),
+
 	/* Always keep this last */
 	ENUM_ELEMENT_LAST(__HostEvent_Last)
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_ioctl.h b/mxm_wifiex/wlan_src/mlan/mlan_ioctl.h
index dd27a94..8153a98 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_ioctl.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_ioctl.h
@@ -489,6 +489,21 @@ typedef MLAN_PACK_START struct _tx_status_event {
 	t_u8 status;
 } MLAN_PACK_END tx_status_event;
 
+typedef MLAN_PACK_START struct _tx_mgmt_status_event {
+	/** packet type */
+	t_u8 packet_type;
+	/** tx_token_id */
+	t_u8 tx_token_id;
+	/** 0--success, 1--fail, 2--watchdogtimeout */
+	t_u8 status;
+} MLAN_PACK_END tx_mgmt_status_event;
+
+typedef MLAN_PACK_START struct _tx_bulk_status_event {
+	/* bulk event is multi set for tx_status [bulk1 bulk2 ...bulk128]
+     bulk1 { packet_type, tx_token_id, status } so on.
+  */
+	tx_mgmt_status_event bulk_events[128];
+} MLAN_PACK_END tx_bulk_status_event;
 /**
  *  Sructure to retrieve the scan table
  */
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_main.h b/mxm_wifiex/wlan_src/mlan/mlan_main.h
index 7530c26..3eaf14d 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_main.h
+++ b/mxm_wifiex/wlan_src/mlan/mlan_main.h
@@ -1931,6 +1931,8 @@ typedef struct _mlan_init_para {
 	t_u8 passive_to_active_scan;
 	/** uap max sta */
 	t_u8 uap_max_sta;
+	/** wacp mode */
+	t_u8 wacp_mode;
 	/** dfs w53 cfg */
 	t_u8 dfs53cfg;
 	/** dfs_offload */
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_shim.c b/mxm_wifiex/wlan_src/mlan/mlan_shim.c
index 09026dc..5071576 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_shim.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_shim.c
@@ -325,6 +325,7 @@ mlan_status mlan_register(pmlan_device pmdevice, t_void **ppmlan_adapter)
 	pmadapter->card_type = pmdevice->card_type;
 	pmadapter->card_rev = pmdevice->card_rev;
 	pmadapter->init_para.uap_max_sta = pmdevice->uap_max_sta;
+	pmadapter->init_para.wacp_mode = pmdevice->wacp_mode;
 	pmadapter->init_para.mcs32 = pmdevice->mcs32;
 	pmadapter->init_para.antcfg = pmdevice->antcfg;
 	pmadapter->init_para.dmcs = pmdevice->dmcs;
@@ -1459,10 +1460,16 @@ mlan_status mlan_send_packet(t_void *padapter, pmlan_buffer pmbuf)
 
 	/** Identify ICMP packet from ETH_IP packet. ICMP packet in IP header
 	 * Protocol field is 0x01 */
-	if (eth_type == MLAN_ETHER_PKT_TYPE_IP) {
-		ip_protocol = *((t_u8 *)(pmbuf->pbuf + pmbuf->data_offset +
-					 MLAN_ETHER_PKT_TYPE_OFFSET +
-					 MLAN_IP_PROTOCOL_OFFSET));
+	/** Enable the ICMP_VIA_BYPASS_TXQ only if wacp_mode is enabled */
+	if ((pmadapter->init_para.wacp_mode) &&
+	    (pmpriv->bss_role == MLAN_BSS_ROLE_UAP &&
+	     pmpriv->uap_bss_started)) {
+		if (eth_type == MLAN_ETHER_PKT_TYPE_IP) {
+			ip_protocol =
+				*((t_u8 *)(pmbuf->pbuf + pmbuf->data_offset +
+					   MLAN_ETHER_PKT_TYPE_OFFSET +
+					   MLAN_IP_PROTOCOL_OFFSET));
+		}
 	}
 
 	if ((eth_type == MLAN_ETHER_PKT_TYPE_EAPOL) ||
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_sta_ioctl.c b/mxm_wifiex/wlan_src/mlan/mlan_sta_ioctl.c
index b084052..f6f9a0b 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_sta_ioctl.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_sta_ioctl.c
@@ -2613,7 +2613,7 @@ static mlan_status wlan_sec_ioctl_set_wep_key(pmlan_adapter pmadapter,
 	mrvl_wep_key_t *pwep_key = MNULL;
 	int index;
 	int i = 0;
-
+	int max_key_index = 5;
 	ENTER();
 
 	if (pmpriv->wep_key_curr_index >= MRVL_NUM_WEP_KEY)
@@ -2625,8 +2625,11 @@ static mlan_status wlan_sec_ioctl_set_wep_key(pmlan_adapter pmadapter,
 		sec->param.encrypt_key.key_index = index;
 	} else {
 		if (sec->param.encrypt_key.key_index >= MRVL_NUM_WEP_KEY) {
+			if (IS_FW_SUPPORT_BEACON_PROT(pmadapter))
+				max_key_index = 7;
 			if ((sec->param.encrypt_key.key_remove == MTRUE) &&
-			    (sec->param.encrypt_key.key_index <= 5)) {
+			    (sec->param.encrypt_key.key_index <=
+			     max_key_index)) {
 				/* call firmware remove key */
 				ret = wlan_prepare_cmd(
 					pmpriv, HostCmd_CMD_802_11_KEY_MATERIAL,
@@ -2637,7 +2640,8 @@ static mlan_status wlan_sec_ioctl_set_wep_key(pmlan_adapter pmadapter,
 					ret = MLAN_STATUS_PENDING;
 				goto exit;
 			}
-			PRINTM(MERROR, "Key_index is invalid\n");
+			PRINTM(MERROR, "Key_index %d is invalid.\n",
+			       sec->param.encrypt_key.key_index);
 			ret = MLAN_STATUS_FAILURE;
 			goto exit;
 		}
diff --git a/mxm_wifiex/wlan_src/mlan/mlan_uap_cmdevent.c b/mxm_wifiex/wlan_src/mlan/mlan_uap_cmdevent.c
index 34db731..4c72e9d 100644
--- a/mxm_wifiex/wlan_src/mlan/mlan_uap_cmdevent.c
+++ b/mxm_wifiex/wlan_src/mlan/mlan_uap_cmdevent.c
@@ -2488,6 +2488,7 @@ static mlan_status wlan_uap_ret_sys_config(pmlan_private pmpriv,
 	MrvlIEtypes_MacAddr_t *tlv =
 		(MrvlIEtypes_MacAddr_t *)sys_config->tlv_buffer;
 	mlan_ds_misc_custom_ie *cust_ie = MNULL;
+	MrvlIEtypes_wacp_mode_t *tlv_wacp_mode = MNULL;
 	tlvbuf_max_mgmt_ie *max_mgmt_ie = MNULL;
 	MrvlIEtypes_wmm_parameter_t *tlv_wmm_parameter =
 		(MrvlIEtypes_wmm_parameter_t *)sys_config->tlv_buffer;
@@ -2807,6 +2808,17 @@ static mlan_status wlan_uap_ret_sys_config(pmlan_private pmpriv,
 							sizeof(tlvbuf_max_mgmt_ie));
 					}
 				}
+			} else if (misc->sub_command ==
+				   MLAN_OID_MISC_WACP_MODE) {
+				tlv_wacp_mode = (MrvlIEtypes_wacp_mode_t *)
+							sys_config->tlv_buffer;
+				misc->param.wacp_mode =
+					tlv_wacp_mode->wacp_mode;
+				/** update the wacp_mode in mlan_adapter */
+				if (pioctl_buf->action == MLAN_ACT_SET) {
+					pmpriv->adapter->init_para.wacp_mode =
+						misc->param.wacp_mode;
+				}
 			}
 		}
 	} else { /* no ioctl: driver generated get/set */
@@ -6054,6 +6066,10 @@ mlan_status wlan_ops_uap_process_event(t_void *priv)
 		PRINTM(MINFO, "EVENT: TX_STATUS\n");
 		pevent->event_id = MLAN_EVENT_ID_FW_TX_STATUS;
 		break;
+	case EVENT_TX_STATUS_BULK_REPORT:
+		PRINTM(MINFO, "EVENT: TX_BULK_STATUS\n");
+		pevent->event_id = MLAN_EVENT_ID_FW_TX_BULK_STATUS;
+		break;
 	case EVENT_BT_COEX_WLAN_PARA_CHANGE:
 		PRINTM(MEVENT, "EVENT: BT coex wlan param update\n");
 		wlan_bt_coex_wlan_param_update_event(pmpriv, pmbuf);
diff --git a/mxm_wifiex/wlan_src/mlinux/mlan_decl.h b/mxm_wifiex/wlan_src/mlinux/mlan_decl.h
index d392e09..3386669 100644
--- a/mxm_wifiex/wlan_src/mlinux/mlan_decl.h
+++ b/mxm_wifiex/wlan_src/mlinux/mlan_decl.h
@@ -847,6 +847,7 @@ typedef enum _mlan_event_id {
 	MLAN_EVENT_ID_SSU_DUMP_FILE = 0x00000039,
 #endif /* SSU_SUPPORT */
 	MLAN_EVENT_ID_CSI = 0x00000040,
+	MLAN_EVENT_ID_FW_TX_BULK_STATUS = 0x00000043,
 	/* Event generated by MLAN driver (MSB=1) */
 	MLAN_EVENT_ID_DRV_CONNECTED = 0x80000001,
 	MLAN_EVENT_ID_DRV_DEFER_HANDLING = 0x80000002,
@@ -2730,6 +2731,8 @@ typedef struct _mlan_device {
 	t_u8 passive_to_active_scan;
 	/** uap max supported station per chip */
 	t_u8 uap_max_sta;
+	/** wacp mode */
+	t_u8 wacp_mode;
 	/** drv mode */
 	t_u32 drv_mode;
 	/** dfs w53 cfg */
diff --git a/mxm_wifiex/wlan_src/mlinux/mlan_ioctl.h b/mxm_wifiex/wlan_src/mlinux/mlan_ioctl.h
index dd27a94..8153a98 100644
--- a/mxm_wifiex/wlan_src/mlinux/mlan_ioctl.h
+++ b/mxm_wifiex/wlan_src/mlinux/mlan_ioctl.h
@@ -489,6 +489,21 @@ typedef MLAN_PACK_START struct _tx_status_event {
 	t_u8 status;
 } MLAN_PACK_END tx_status_event;
 
+typedef MLAN_PACK_START struct _tx_mgmt_status_event {
+	/** packet type */
+	t_u8 packet_type;
+	/** tx_token_id */
+	t_u8 tx_token_id;
+	/** 0--success, 1--fail, 2--watchdogtimeout */
+	t_u8 status;
+} MLAN_PACK_END tx_mgmt_status_event;
+
+typedef MLAN_PACK_START struct _tx_bulk_status_event {
+	/* bulk event is multi set for tx_status [bulk1 bulk2 ...bulk128]
+     bulk1 { packet_type, tx_token_id, status } so on.
+  */
+	tx_mgmt_status_event bulk_events[128];
+} MLAN_PACK_END tx_bulk_status_event;
 /**
  *  Sructure to retrieve the scan table
  */
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.h b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.h
index dfd9e6d..801e5fd 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_cfg80211_util.h
@@ -489,7 +489,12 @@ int woal_packet_fate_monitor(moal_private *priv,
  * Version of APF instruction set processed by accept_packet().
  * Should be returned by wifi_get_packet_filter_info.
  */
+#if (defined(ANDROID_SDK_VERSION) && ANDROID_SDK_VERSION >= 34)
+#define APF_VERSION 4
+#else
 #define APF_VERSION 2
+#endif
+
 /** =========== Define Copied from apf_interpreter.h END =========== */
 
 /** =========== Define Copied from apf_interpreter.c START =========== */
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_main.c b/mxm_wifiex/wlan_src/mlinux/moal_main.c
index ff1124b..6a6d506 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_main.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_main.c
@@ -2434,6 +2434,7 @@ mlan_status woal_init_sw(moal_handle *handle)
 	device.inact_tmo = handle->params.inact_tmo;
 #ifdef UAP_SUPPORT
 	device.uap_max_sta = handle->params.uap_max_sta;
+	device.wacp_mode = handle->params.wacp_mode;
 #endif
 	device.mcs32 = handle->params.mcs32;
 	device.hs_wake_interval = handle->params.hs_wake_interval;
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_shim.c b/mxm_wifiex/wlan_src/mlinux/moal_shim.c
index 668ee48..88888b1 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_shim.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_shim.c
@@ -2704,6 +2704,88 @@ static mlan_status wlan_process_defer_event(moal_handle *handle,
 	return status;
 }
 
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+/**
+ *  @brief This function handles event receive
+ *
+ *  @param priv Pointer to the MOAL private
+ *  @param tx_status  pointer to tx_mgmt_status_event structure
+ *
+ *  @return         N/A
+ */
+t_void woal_process_event_tx_status(moal_private *priv,
+				    tx_mgmt_status_event *tx_status)
+{
+	unsigned long flag;
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+	moal_private *remain_priv = NULL;
+	t_u8 channel_status;
+#endif
+	struct tx_status_info *tx_info = NULL;
+	PRINTM(MEVENT,
+	       "Wlan: Tx status: tx_token=%d, pkt_type=0x%x, status=%d priv->tx_seq_num=%d\n",
+	       tx_status->tx_token_id, tx_status->packet_type,
+	       tx_status->status, priv->tx_seq_num);
+	spin_lock_irqsave(&priv->tx_stat_lock, flag);
+	tx_info = woal_get_tx_info(priv, tx_status->tx_token_id);
+	if (tx_info) {
+		bool ack;
+		struct sk_buff *skb = (struct sk_buff *)tx_info->tx_skb;
+		list_del(&tx_info->link);
+		spin_unlock_irqrestore(&priv->tx_stat_lock, flag);
+		if (!tx_status->status)
+			ack = true;
+		else
+			ack = false;
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+		if (priv->phandle->remain_on_channel &&
+		    tx_info->cancel_remain_on_channel) {
+			remain_priv =
+				priv->phandle
+					->priv[priv->phandle->remain_bss_index];
+			if (remain_priv) {
+				if (woal_cfg80211_remain_on_channel_cfg(
+					    remain_priv, MOAL_NO_WAIT, MTRUE,
+					    &channel_status, NULL, 0, 0))
+					PRINTM(MERROR,
+					       "remain_on_channel: Failed to cancel\n");
+
+				priv->phandle->remain_on_channel = MFALSE;
+			}
+		}
+#endif
+		PRINTM(MEVENT, "Wlan: Tx status=%d\n", ack);
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+		if (tx_info->tx_cookie) {
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(2, 6, 37)
+#if CFG80211_VERSION_CODE < KERNEL_VERSION(3, 6, 0)
+			cfg80211_mgmt_tx_status(priv->netdev,
+						tx_info->tx_cookie, skb->data,
+						skb->len, ack, GFP_ATOMIC);
+#else
+			cfg80211_mgmt_tx_status(priv->wdev, tx_info->tx_cookie,
+						skb->data, skb->len, ack,
+						GFP_ATOMIC);
+#endif
+#endif
+		}
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+#if CFG80211_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)
+		woal_packet_fate_monitor(
+			priv, PACKET_TYPE_TX,
+			ack ? TX_PKT_FATE_ACKED : TX_PKT_FATE_SENT,
+			FRAME_TYPE_80211_MGMT, 0, 0, skb->data, skb->len);
+#endif
+#endif
+#endif
+		dev_kfree_skb_any(skb);
+		kfree(tx_info);
+	} else {
+		spin_unlock_irqrestore(&priv->tx_stat_lock, flag);
+	}
+}
+#endif
+
 /**
  *  @brief This function handles event receive
  *
@@ -4568,6 +4650,25 @@ mlan_status moal_recv_event(t_void *pmoal, pmlan_event pmevent)
 		} else {
 			spin_unlock_irqrestore(&priv->tx_stat_lock, flag);
 		}
+#endif
+	} break;
+	case MLAN_EVENT_ID_FW_TX_BULK_STATUS: {
+#if defined(STA_CFG80211) || defined(UAP_CFG80211)
+		tx_bulk_status_event *tx_status =
+			(tx_bulk_status_event *)(pmevent->event_buf + 4);
+		t_u8 curID = 0, num_of_events = 0, payload_len = 0;
+
+		payload_len = (pmevent->event_len - 4);
+		num_of_events =
+			((payload_len) / (sizeof(tx_mgmt_status_event)));
+
+		PRINTM(MEVENT,
+		       "Wlan: Bulk Tx status total_len=%d num_of_events=%d\n",
+		       payload_len, num_of_events);
+		while (curID < num_of_events) {
+			woal_process_event_tx_status(
+				priv, &(tx_status->bulk_events[curID++]));
+		}
 #endif
 	} break;
 	case MLAN_EVENT_ID_DRV_FT_RESPONSE:
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.c b/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.c
index 5e36dd8..dcdc5ab 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_sta_cfg80211.c
@@ -2102,7 +2102,7 @@ static int woal_cfg80211_auth_scan(moal_private *priv,
  *  @return       MLAN_STATUS_SUCCESS/MLAN_STATUS_PENDING
  *                  -- success, otherwise fail
  */
-static mlan_status woal_request_set_host_mlme(moal_private *priv, t_u8 *bssid)
+mlan_status woal_request_set_host_mlme(moal_private *priv, t_u8 *bssid)
 {
 	mlan_ioctl_req *req = NULL;
 	mlan_ds_bss *bss = NULL;
@@ -2610,11 +2610,7 @@ void woal_host_mlme_process_assoc_resp(moal_private *priv,
 	struct cfg80211_bss *bss = NULL;
 	unsigned long flags;
 	u8 *assoc_req_buf = NULL;
-#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 7, 0)) || IMX_ANDROID_14)
-	struct cfg80211_rx_assoc_resp_data resp = {
-		.uapsd_queues = -1,
-	};
-#elif ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) || IMX_ANDROID_14)
+#if ((CFG80211_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) || IMX_ANDROID_14)
 	struct cfg80211_rx_assoc_resp resp = {
 		.uapsd_queues = -1,
 	};
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_uap.c b/mxm_wifiex/wlan_src/mlinux/moal_uap.c
index b294400..7c0f70e 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_uap.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_uap.c
@@ -2549,6 +2549,80 @@ done:
 	return ret;
 }
 
+/**
+ * @brief Set/Get wacp_mode
+ *
+ *  @param dev      A pointer to net_device structure
+ *  @param req      A pointer to ifreq structure
+ *
+ * @return           0 --success, otherwise fail
+ */
+int woal_uap_wacp_mode(struct net_device *dev, struct ifreq *req)
+{
+	moal_private *priv = (moal_private *)netdev_priv(dev);
+	mlan_ioctl_req *ioctl_req = NULL;
+	mlan_ds_misc_cfg *pcfg_misc = NULL;
+	wacp_mode_para param;
+	int ret = 0;
+	mlan_status status = MLAN_STATUS_SUCCESS;
+
+	ENTER();
+
+	/* Sanity check */
+	if (req->ifr_data == NULL) {
+		PRINTM(MERROR, "woal_uap_wacp_mode() corrupt data\n");
+		ret = -EFAULT;
+		goto done;
+	}
+	memset(&param, 0, sizeof(wacp_mode_para));
+	/* Get user data */
+	if (copy_from_user(&param, req->ifr_data, sizeof(wacp_mode_para))) {
+		PRINTM(MERROR, "Copy from user failed\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+	/* Allocate an IOCTL request buffer */
+	ioctl_req = woal_alloc_mlan_ioctl_req(sizeof(mlan_ds_misc_cfg));
+	if (ioctl_req == NULL) {
+		status = MLAN_STATUS_FAILURE;
+		goto done;
+	}
+
+	/* Fill request buffer */
+	pcfg_misc = (mlan_ds_misc_cfg *)ioctl_req->pbuf;
+	pcfg_misc->sub_command = MLAN_OID_MISC_WACP_MODE;
+	ioctl_req->req_id = MLAN_IOCTL_MISC_CFG;
+	ioctl_req->action = param.action;
+	pcfg_misc->param.wacp_mode = param.wacp_mode;
+
+	/* Send IOCTL request to MLAN */
+	status = woal_request_ioctl(priv, ioctl_req, MOAL_IOCTL_WAIT);
+	if (status != MLAN_STATUS_SUCCESS) {
+		ret = -EFAULT;
+		goto done;
+	}
+
+	param.wacp_mode = pcfg_misc->param.wacp_mode;
+	/** Update the moal wacp_mode */
+	if (param.action == MLAN_ACT_SET) {
+		priv->phandle->params.wacp_mode = param.wacp_mode;
+	}
+
+	/* Copy to user */
+	if (copy_to_user(req->ifr_data, &param, sizeof(param))) {
+		PRINTM(MERROR, "Copy to user failed!\n");
+		ret = -EFAULT;
+		goto done;
+	}
+
+done:
+	if (status != MLAN_STATUS_PENDING)
+		kfree(ioctl_req);
+	LEAVE();
+	return ret;
+}
+
 /**
  *  @brief uap ioctl handler
  *
@@ -2655,6 +2729,9 @@ static int woal_uap_ioctl(struct net_device *dev, struct ifreq *req)
 	case UAP_BEACON_STUCK_DETECT:
 		ret = woal_uap_beacon_stuck(dev, req);
 		break;
+	case UAP_WACP_MODE:
+		woal_uap_wacp_mode(dev, req);
+		break;
 	default:
 		break;
 	}
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_uap.h b/mxm_wifiex/wlan_src/mlinux/moal_uap.h
index 1c4d25c..686ed37 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_uap.h
+++ b/mxm_wifiex/wlan_src/mlinux/moal_uap.h
@@ -88,6 +88,9 @@ Change log:
 
 #define UAP_BEACON_STUCK_DETECT 25
 
+/** wacp_mode Config */
+#define UAP_WACP_MODE 26
+
 /** Private command ID to Power Mode */
 #define UAP_POWER_MODE (SIOCDEVPRIVATE + 3)
 
@@ -208,6 +211,19 @@ typedef struct _skip_cac_para {
 	t_u8 bw;
 } skip_cac_para;
 
+typedef struct _wacp_mode_para {
+	/** Action */
+	t_u32 subcmd;
+	/** Action */
+	t_u32 action;
+	/** TLV type*/
+	t_u16 type;
+	/** TLV length */
+	t_u16 len;
+	/** wacp_mode */
+	t_u8 wacp_mode;
+} wacp_mode_para;
+
 /** radio control command */
 #define UAP_RADIO_CTL (SIOCDEVPRIVATE + 5)
 
diff --git a/mxm_wifiex/wlan_src/mlinux/moal_uap_cfg80211.c b/mxm_wifiex/wlan_src/mlinux/moal_uap_cfg80211.c
index c146e9c..f853522 100644
--- a/mxm_wifiex/wlan_src/mlinux/moal_uap_cfg80211.c
+++ b/mxm_wifiex/wlan_src/mlinux/moal_uap_cfg80211.c
@@ -263,16 +263,16 @@ static t_u8 woal_check_rsn_ie(IEEEtypes_Rsn_t *rsn_ie,
 			break;
 		}
 	}
-	left -= sizeof(IEEEtypes_Rsn_t) + (count - 1) * sizeof(wpa_suite);
-	if (left < (int)sizeof(wpa_suite_auth_key_mgmt_t))
+	left -= sizeof(IEEEtypes_Rsn_t) + (count) * sizeof(wpa_suite);
+	if (left <
+	    ((int)sizeof(wpa_suite_auth_key_mgmt_t) + (int)sizeof(wpa_suite)))
 		return MFALSE;
-	key_mgmt =
-		(wpa_suite_auth_key_mgmt_t *)((u8 *)rsn_ie +
-					      sizeof(IEEEtypes_Rsn_t) +
-					      (count - 1) * sizeof(wpa_suite));
+	key_mgmt = (wpa_suite_auth_key_mgmt_t *)((u8 *)rsn_ie +
+						 sizeof(IEEEtypes_Rsn_t) +
+						 (count) * sizeof(wpa_suite));
 	count = woal_le16_to_cpu(key_mgmt->count);
-	if (left < (int)(sizeof(wpa_suite_auth_key_mgmt_t) +
-			 (count - 1) * sizeof(wpa_suite)))
+	if (left < ((int)sizeof(wpa_suite_auth_key_mgmt_t) +
+		    (count) * (int)sizeof(wpa_suite)))
 		return MFALSE;
 	for (i = 0; i < count; i++) {
 		switch (key_mgmt->list[i].type) {
@@ -343,16 +343,16 @@ static t_u8 woal_check_wpa_ie(IEEEtypes_Wpa_t *wpa_ie,
 			break;
 		}
 	}
-	left -= sizeof(IEEEtypes_Wpa_t) + (count - 1) * sizeof(wpa_suite);
-	if (left < (int)sizeof(wpa_suite_auth_key_mgmt_t))
+	left -= sizeof(IEEEtypes_Wpa_t) + (count) * sizeof(wpa_suite);
+	if (left <
+	    ((int)sizeof(wpa_suite_auth_key_mgmt_t) + (int)sizeof(wpa_suite)))
 		return MFALSE;
-	key_mgmt =
-		(wpa_suite_auth_key_mgmt_t *)((u8 *)wpa_ie +
-					      sizeof(IEEEtypes_Wpa_t) +
-					      (count - 1) * sizeof(wpa_suite));
+	key_mgmt = (wpa_suite_auth_key_mgmt_t *)((u8 *)wpa_ie +
+						 sizeof(IEEEtypes_Wpa_t) +
+						 (count) * sizeof(wpa_suite));
 	count = woal_le16_to_cpu(key_mgmt->count);
-	if (left < (int)(sizeof(wpa_suite_auth_key_mgmt_t) +
-			 (count - 1) * sizeof(wpa_suite)))
+	if (left < ((int)sizeof(wpa_suite_auth_key_mgmt_t) +
+		    (count) * (int)sizeof(wpa_suite)))
 		return MFALSE;
 	for (i = 0; i < count; i++) {
 		switch (key_mgmt->list[i].type) {