6 GHz on Cambium Networks XE3-4

Has anybody gotten 6 GHz to work on the Cambium Networks XE3-4? I recently got my hands on one and installed the latest stable 25.12.4 on it.

I know that initially, @Spacebar just got 5 GHz to work on the third radio (see Add support for Cambium Networks XE3-4 ipq6010 - #58 by Spacebar), which is also what works for me. Plus, there was some discussion around that topic (see Qualcommax & ath11k board calibration & BDF data woes - #88 by Spacebar). But did this ever conclude?

Anyway, for me, the third radio PHY does not even advertise anything at 6 GHz.

root@OpenWrt2:~# iw phy phy2 info
Wiphy phy2
	wiphy index: 2
	max # scan SSIDs: 16
	max scan IEs length: 398 bytes
	max # sched scan SSIDs: 0
	max # match sets: 0
	Retry short limit: 7
	Retry long limit: 4
	Coverage class: 0 (up to 0m)
	Device supports AP-side u-APSD.
	Available Antennas: TX 0xf RX 0xf
	Configured Antennas: TX 0xf RX 0xf
	Supported interface modes:
		 * managed
		 * AP
		 * monitor
		 * mesh point
	Band 2:
		Capabilities: 0x19e7
			RX LDPC
			HT20/HT40
			Dynamic SM Power Save
			RX HT20 SGI
			RX HT40 SGI
			TX STBC
			RX STBC 1-stream
			Max AMSDU length: 7935 bytes
			DSSS/CCK HT40
		Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
		Minimum RX AMPDU time spacing: No restriction (0x00)
		HT TX/RX MCS rate indexes supported: 0-31
		VHT Capabilities (0x338bf9fa):
			Max MPDU length: 11454
			Supported Channel Width: 160 MHz, 80+80 MHz
			RX LDPC
			short GI (80 MHz)
			short GI (160/80+80 MHz)
			TX STBC
			SU Beamformer
			SU Beamformee
			MU Beamformer
			RX antenna pattern consistency
			TX antenna pattern consistency
		VHT RX MCS set:
			1 streams: MCS 0-9
			2 streams: MCS 0-9
			3 streams: MCS 0-9
			4 streams: MCS 0-9
			5 streams: not supported
			6 streams: not supported
			7 streams: not supported
			8 streams: not supported
		VHT RX highest supported: 0 Mbps
		VHT TX MCS set:
			1 streams: MCS 0-9
			2 streams: MCS 0-9
			3 streams: MCS 0-9
			4 streams: MCS 0-9
			5 streams: not supported
			6 streams: not supported
			7 streams: not supported
			8 streams: not supported
		VHT TX highest supported: 0 Mbps
		VHT extended NSS: supported
		HE Iftypes: managed
			HE MAC Capabilities (0x000b9a181040):
				+HTC HE Supported
				TWT Requester
				Dynamic BA Fragementation Level: 1
				BSR
				Broadcast TWT
				OM Control
				Maximum A-MPDU Length Exponent: 3
				RX Control Frame to MultiBSS
				A-MSDU in A-MPDU
				OM Control UL MU Data Disable RX
			HE PHY Capabilities: (0x1c604c89ffdb839c110c00):
				HE40/HE80/5GHz
				HE160/5GHz
				HE160/HE80+80/5GHz
				LDPC Coding in Payload
				HE SU PPDU with 1x HE-LTF and 0.8us GI
				STBC Tx <= 80MHz
				STBC Rx <= 80MHz
				Full Bandwidth UL MU-MIMO
				DCM Max Constellation: 1
				DCM Max Constellation Rx: 1
				SU Beamformer
				SU Beamformee
				MU Beamformer
				Beamformee STS <= 80MHz: 7
				Beamformee STS > 80MHz: 7
				Sounding Dimensions <= 80MHz: 3
				Sounding Dimensions > 80MHz: 3
				Ng = 16 SU Feedback
				Ng = 16 MU Feedback
				Codebook Size SU Feedback
				Codebook Size MU Feedback
				PPE Threshold Present
				HE SU PPDU & HE PPDU 4x HE-LTF 0.8us GI
				Max NC: 3
				STBC Rx > 80MHz
				HE ER SU PPDU 4x HE-LTF 0.8us GI
				HE ER SU PPDU 1x HE-LTF 0.8us GI
				TX 1024-QAM
				RX 1024-QAM
			HE RX MCS and NSS set <= 80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE TX MCS and NSS set <= 80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE RX MCS and NSS set 160 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE TX MCS and NSS set 160 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE RX MCS and NSS set 80+80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE TX MCS and NSS set 80+80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			PPE Threshold 0x7b 0x1c 0xc7 0x71 0x1c 0xc7 0x71 0x1c 0xc7 0x71 0x1c 0xc7 0x71 
		HE Iftypes: AP
			HE MAC Capabilities (0x000d9a181040):
				+HTC HE Supported
				TWT Responder
				Dynamic BA Fragementation Level: 1
				BSR
				Broadcast TWT
				OM Control
				Maximum A-MPDU Length Exponent: 3
				RX Control Frame to MultiBSS
				A-MSDU in A-MPDU
				OM Control UL MU Data Disable RX
			HE PHY Capabilities: (0x1c604c88ffdb839c110c00):
				HE40/HE80/5GHz
				HE160/5GHz
				HE160/HE80+80/5GHz
				LDPC Coding in Payload
				HE SU PPDU with 1x HE-LTF and 0.8us GI
				STBC Tx <= 80MHz
				STBC Rx <= 80MHz
				Full Bandwidth UL MU-MIMO
				DCM Max Constellation Rx: 1
				SU Beamformer
				SU Beamformee
				MU Beamformer
				Beamformee STS <= 80MHz: 7
				Beamformee STS > 80MHz: 7
				Sounding Dimensions <= 80MHz: 3
				Sounding Dimensions > 80MHz: 3
				Ng = 16 SU Feedback
				Ng = 16 MU Feedback
				Codebook Size SU Feedback
				Codebook Size MU Feedback
				PPE Threshold Present
				HE SU PPDU & HE PPDU 4x HE-LTF 0.8us GI
				Max NC: 3
				STBC Rx > 80MHz
				HE ER SU PPDU 4x HE-LTF 0.8us GI
				HE ER SU PPDU 1x HE-LTF 0.8us GI
				TX 1024-QAM
				RX 1024-QAM
			HE RX MCS and NSS set <= 80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE TX MCS and NSS set <= 80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE RX MCS and NSS set 160 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE TX MCS and NSS set 160 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE RX MCS and NSS set 80+80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE TX MCS and NSS set 80+80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			PPE Threshold 0x7b 0x1c 0xc7 0x71 0x1c 0xc7 0x71 0x1c 0xc7 0x71 0x1c 0xc7 0x71 
		HE Iftypes: mesh point
			HE MAC Capabilities (0x00098a081040):
				+HTC HE Supported
				Dynamic BA Fragementation Level: 1
				BSR
				OM Control
				Maximum A-MPDU Length Exponent: 1
				RX Control Frame to MultiBSS
				A-MSDU in A-MPDU
				OM Control UL MU Data Disable RX
			HE PHY Capabilities: (0x1c600c80fd5b811c100000):
				HE40/HE80/5GHz
				HE160/5GHz
				HE160/HE80+80/5GHz
				LDPC Coding in Payload
				HE SU PPDU with 1x HE-LTF and 0.8us GI
				STBC Tx <= 80MHz
				STBC Rx <= 80MHz
				SU Beamformer
				SU Beamformee
				Beamformee STS <= 80MHz: 7
				Beamformee STS > 80MHz: 7
				Sounding Dimensions <= 80MHz: 3
				Sounding Dimensions > 80MHz: 3
				Ng = 16 SU Feedback
				Codebook Size SU Feedback
				PPE Threshold Present
				HE SU PPDU & HE PPDU 4x HE-LTF 0.8us GI
				Max NC: 3
				HE ER SU PPDU 1x HE-LTF 0.8us GI
			HE RX MCS and NSS set <= 80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE TX MCS and NSS set <= 80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE RX MCS and NSS set 160 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE TX MCS and NSS set 160 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE RX MCS and NSS set 80+80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE TX MCS and NSS set 80+80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			PPE Threshold 0x7b 0x1c 0xc7 0x71 0x1c 0xc7 0x71 0x1c 0xc7 0x71 0x1c 0xc7 0x71 
		Frequencies:
			* 5180.0 MHz [36] (23.0 dBm)
			* 5200.0 MHz [40] (23.0 dBm)
			* 5220.0 MHz [44] (23.0 dBm)
			* 5240.0 MHz [48] (23.0 dBm)
			* 5260.0 MHz [52] (23.0 dBm) (radar detection)
			* 5280.0 MHz [56] (23.0 dBm) (radar detection)
			* 5300.0 MHz [60] (23.0 dBm) (radar detection)
			* 5320.0 MHz [64] (23.0 dBm) (radar detection)
			* 5500.0 MHz [100] (30.0 dBm) (radar detection)
			* 5520.0 MHz [104] (30.0 dBm) (radar detection)
			* 5540.0 MHz [108] (30.0 dBm) (radar detection)
			* 5560.0 MHz [112] (30.0 dBm) (radar detection)
			* 5580.0 MHz [116] (30.0 dBm) (radar detection)
			* 5600.0 MHz [120] (30.0 dBm) (radar detection)
			* 5620.0 MHz [124] (30.0 dBm) (radar detection)
			* 5640.0 MHz [128] (30.0 dBm) (radar detection)
			* 5660.0 MHz [132] (30.0 dBm) (radar detection)
			* 5680.0 MHz [136] (30.0 dBm) (radar detection)
			* 5700.0 MHz [140] (30.0 dBm) (radar detection)
			* 5720.0 MHz [144] (disabled)
			* 5745.0 MHz [149] (disabled)
			* 5765.0 MHz [153] (disabled)
			* 5785.0 MHz [157] (disabled)
			* 5805.0 MHz [161] (disabled)
			* 5825.0 MHz [165] (disabled)
			* 5845.0 MHz [169] (disabled)
			* 5865.0 MHz [173] (disabled)
			* 5885.0 MHz [177] (disabled)
	valid interface combinations:
		 * #{ managed } <= 1, #{ AP, mesh point } <= 16,
		   total <= 16, #channels <= 1, STA/AP BI must match, radar detect widths: { 20 MHz (no HT), 20 MHz, 40 MHz, 80 MHz, 80+80 MHz, 160 MHz }

	HT Capability overrides:
		 * MCS: ff ff ff ff ff ff ff ff ff ff
		 * maximum A-MSDU length
		 * supported channel width
		 * short GI for 40 MHz
		 * max A-MPDU length exponent
		 * min MPDU start spacing
	max # scan plans: 1
	max scan plan interval: -1
	max scan plan iterations: 0
	Maximum associated stations in AP mode: 512
	Supported extended features:
		* [ RRM ]: RRM
		* [ SET_SCAN_DWELL ]: scan dwell setting
		* [ FILS_STA ]: STA FILS (Fast Initial Link Setup)
		* [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
		* [ CONTROL_PORT_OVER_NL80211 ]: control port over nl80211
		* [ ACK_SIGNAL_SUPPORT ]: ack signal level support
		* [ TXQS ]: FQ-CoDel-enabled intermediate TXQs
		* [ ENABLE_FTM_RESPONDER ]: enable FTM (Fine Time Measurement) responder
		* [ STA_TX_PWR ]: TX power control per station
		* [ CONTROL_PORT_NO_PREAUTH ]: disable pre-auth over nl80211 control port support
		* [ SCAN_FREQ_KHZ ]: scan on kHz frequency support
		* [ CONTROL_PORT_OVER_NL80211_TX_STATUS ]: tx status for nl80211 control port support
		* [ BSS_COLOR ]: BSS coloring support
		* [ POWERED_ADDR_CHANGE ]: can change MAC address while up

But how would I get the third radio PHY to actually advertise 6 GHz support? I assume a different BDF would be needed, correct? But how to get that?

BTW: I also started collecting some lore around installation, etc., and created a device page for the XE3-4.

Thanks!