Pineapple6 QCN9074 Tx power stuck

Im using two pineapple6 m2 cards from 8devices. The TX power at 6GHz 20MHz should be around 28dBm. However I managed to only get a consistent reading of 18dBm. There is nothing weird in dmesg or logread. There is also the known 255dBm software bug. I can set the txpower lower but definitely not higher. Using an AP client configuration. Iw list gives 27 dBm in 6GHz channels. Host is compute module 4 RPI with external power supply so that is not an issue.

root@OpenWrt:~# dmesg | grep ath
[    7.834920] ath11k_pci 0000:01:00.0: BAR 0: assigned [mem 0x600000000-0x6001fffff 64bit]
[    7.843045] ath11k_pci 0000:01:00.0: enabling device (0000 -> 0002)
[    7.849672] ath11k_pci 0000:01:00.0: MSI vectors: 16
[    7.854637] ath11k_pci 0000:01:00.0: qcn9074 hw1.0
[    7.859432] ath11k_pci 0000:01:00.0: FW memory mode: 2
[    8.323412] ath11k_pci 0000:01:00.0: chip_id 0x0 chip_family 0x0 board_id 0xa2 soc_id 0xffffffff
[    8.332262] ath11k_pci 0000:01:00.0: fw_version 0x290b8862 fw_build_timestamp 2024-09-23 10:51 fw_build_id 
[   10.075324] ath11k_pci 0000:01:00.0: htt event 48 not handled
[   11.376048] ath11k_pci 0000:01:00.0 phy1-ap0: entered allmulticast mode
[   11.382797] ath11k_pci 0000:01:00.0 phy1-ap0: entered promiscuous mode
root@OpenWrt:~# logread | grep ath
Tue Apr 29 13:54:10 2025 kern.info kernel: [    7.834920] ath11k_pci 0000:01:00.0: BAR 0: assigned [mem 0x600000000-0x6001fffff 64bit]
Tue Apr 29 13:54:10 2025 kern.info kernel: [    7.843045] ath11k_pci 0000:01:00.0: enabling device (0000 -> 0002)
Tue Apr 29 13:54:10 2025 kern.info kernel: [    7.849672] ath11k_pci 0000:01:00.0: MSI vectors: 16
Tue Apr 29 13:54:10 2025 kern.info kernel: [    7.854637] ath11k_pci 0000:01:00.0: qcn9074 hw1.0
Tue Apr 29 13:54:10 2025 kern.info kernel: [    7.859432] ath11k_pci 0000:01:00.0: FW memory mode: 2
Tue Apr 29 13:54:10 2025 kern.info kernel: [    8.323412] ath11k_pci 0000:01:00.0: chip_id 0x0 chip_family 0x0 board_id 0xa2 soc_id 0xffffffff
Tue Apr 29 13:54:10 2025 kern.info kernel: [    8.332262] ath11k_pci 0000:01:00.0: fw_version 0x290b8862 fw_build_timestamp 2024-09-23 10:51 fw_build_id
Tue Apr 29 13:54:12 2025 kern.warn kernel: [   10.075324] ath11k_pci 0000:01:00.0: htt event 48 not handled
Tue Apr 29 13:54:13 2025 kern.info kernel: [   11.376048] ath11k_pci 0000:01:00.0 phy1-ap0: entered allmulticast mode
Tue Apr 29 13:54:13 2025 kern.info kernel: [   11.382797] ath11k_pci 0000:01:00.0 phy1-ap0: entered promiscuous mode
root@OpenWrt:~# iw list
Wiphy phy1
	wiphy index: 1
	max # scan SSIDs: 16
	max scan IEs length: 440 bytes
	max # sched scan SSIDs: 0
	max # match sets: 0
	Retry short limit: 7
	Retry long limit: 4
	Coverage class: 0 (up to 0m)
	Device supports AP-side u-APSD.
	Available Antennas: TX 0xf RX 0xf
	Configured Antennas: TX 0xf RX 0xf
	Supported interface modes:
		 * managed
		 * AP
		 * monitor
		 * mesh point
	Band 4:
		HE Iftypes: managed
			HE MAC Capabilities (0x000b9a181040):
				+HTC HE Supported
				TWT Requester
				Dynamic BA Fragementation Level: 1
				BSR
				Broadcast TWT
				OM Control
				Maximum A-MPDU Length Exponent: 3
				RX Control Frame to MultiBSS
				A-MSDU in A-MPDU
				OM Control UL MU Data Disable RX
			HE PHY Capabilities: (0x1c604c89ffdb839c110c00):
				HE40/HE80/5GHz
				HE160/5GHz
				HE160/HE80+80/5GHz
				LDPC Coding in Payload
				HE SU PPDU with 1x HE-LTF and 0.8us GI
				STBC Tx <= 80MHz
				STBC Rx <= 80MHz
				Full Bandwidth UL MU-MIMO
				DCM Max Constellation: 1
				DCM Max Constellation Rx: 1
				SU Beamformer
				SU Beamformee
				MU Beamformer
				Beamformee STS <= 80Mhz: 7
				Beamformee STS > 80Mhz: 7
				Sounding Dimensions <= 80Mhz: 3
				Sounding Dimensions > 80Mhz: 3
				Ng = 16 SU Feedback
				Ng = 16 MU Feedback
				Codebook Size SU Feedback
				Codebook Size MU Feedback
				PPE Threshold Present
				HE SU PPDU & HE PPDU 4x HE-LTF 0.8us GI
				Max NC: 3
				STBC Rx > 80MHz
				HE ER SU PPDU 4x HE-LTF 0.8us GI
				HE ER SU PPDU 1x HE-LTF 0.8us GI
				TX 1024-QAM
				RX 1024-QAM
			HE RX MCS and NSS set <= 80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE TX MCS and NSS set <= 80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE RX MCS and NSS set 160 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE TX MCS and NSS set 160 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
		HE Iftypes: AP
			HE MAC Capabilities (0x000d9a181040):
				+HTC HE Supported
				TWT Responder
				Dynamic BA Fragementation Level: 1
				BSR
				Broadcast TWT
				OM Control
				Maximum A-MPDU Length Exponent: 3
				RX Control Frame to MultiBSS
				A-MSDU in A-MPDU
				OM Control UL MU Data Disable RX
			HE PHY Capabilities: (0x1c604c88ffdb839c110c00):
				HE40/HE80/5GHz
				HE160/5GHz
				HE160/HE80+80/5GHz
				LDPC Coding in Payload
				HE SU PPDU with 1x HE-LTF and 0.8us GI
				STBC Tx <= 80MHz
				STBC Rx <= 80MHz
				Full Bandwidth UL MU-MIMO
				DCM Max Constellation Rx: 1
				SU Beamformer
				SU Beamformee
				MU Beamformer
				Beamformee STS <= 80Mhz: 7
				Beamformee STS > 80Mhz: 7
				Sounding Dimensions <= 80Mhz: 3
				Sounding Dimensions > 80Mhz: 3
				Ng = 16 SU Feedback
				Ng = 16 MU Feedback
				Codebook Size SU Feedback
				Codebook Size MU Feedback
				PPE Threshold Present
				HE SU PPDU & HE PPDU 4x HE-LTF 0.8us GI
				Max NC: 3
				STBC Rx > 80MHz
				HE ER SU PPDU 4x HE-LTF 0.8us GI
				HE ER SU PPDU 1x HE-LTF 0.8us GI
				TX 1024-QAM
				RX 1024-QAM
			HE RX MCS and NSS set <= 80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE TX MCS and NSS set <= 80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE RX MCS and NSS set 160 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE TX MCS and NSS set 160 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
		HE Iftypes: mesh point
			HE MAC Capabilities (0x00098a081040):
				+HTC HE Supported
				Dynamic BA Fragementation Level: 1
				BSR
				OM Control
				Maximum A-MPDU Length Exponent: 1
				RX Control Frame to MultiBSS
				A-MSDU in A-MPDU
				OM Control UL MU Data Disable RX
			HE PHY Capabilities: (0x1c600c80fd5b811c100000):
				HE40/HE80/5GHz
				HE160/5GHz
				HE160/HE80+80/5GHz
				LDPC Coding in Payload
				HE SU PPDU with 1x HE-LTF and 0.8us GI
				STBC Tx <= 80MHz
				STBC Rx <= 80MHz
				SU Beamformer
				SU Beamformee
				Beamformee STS <= 80Mhz: 7
				Beamformee STS > 80Mhz: 7
				Sounding Dimensions <= 80Mhz: 3
				Sounding Dimensions > 80Mhz: 3
				Ng = 16 SU Feedback
				Codebook Size SU Feedback
				PPE Threshold Present
				HE SU PPDU & HE PPDU 4x HE-LTF 0.8us GI
				Max NC: 3
				HE ER SU PPDU 1x HE-LTF 0.8us GI
			HE RX MCS and NSS set <= 80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE TX MCS and NSS set <= 80 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE RX MCS and NSS set 160 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
			HE TX MCS and NSS set 160 MHz
				1 streams: MCS 0-11
				2 streams: MCS 0-11
				3 streams: MCS 0-11
				4 streams: MCS 0-11
				5 streams: not supported
				6 streams: not supported
				7 streams: not supported
				8 streams: not supported
		Frequencies:
			* 5955.0 MHz [1] (27.0 dBm)
			* 5975.0 MHz [5] (27.0 dBm)
			* 5995.0 MHz [9] (27.0 dBm)
			* 6015.0 MHz [13] (27.0 dBm)
			* 6035.0 MHz [17] (27.0 dBm)
			* 6055.0 MHz [21] (27.0 dBm)
			* 6075.0 MHz [25] (27.0 dBm)
			* 6095.0 MHz [29] (27.0 dBm)
			* 6115.0 MHz [33] (27.0 dBm)
			* 6135.0 MHz [37] (27.0 dBm)
			* 6155.0 MHz [41] (27.0 dBm)
			* 6175.0 MHz [45] (27.0 dBm)
			* 6195.0 MHz [49] (27.0 dBm)
			* 6215.0 MHz [53] (27.0 dBm)
			* 6235.0 MHz [57] (27.0 dBm)
			* 6255.0 MHz [61] (27.0 dBm)
			* 6275.0 MHz [65] (27.0 dBm)
			* 6295.0 MHz [69] (27.0 dBm)
			* 6315.0 MHz [73] (27.0 dBm)
			* 6335.0 MHz [77] (27.0 dBm)
			* 6355.0 MHz [81] (27.0 dBm)
			* 6375.0 MHz [85] (27.0 dBm)
			* 6395.0 MHz [89] (27.0 dBm)
			* 6415.0 MHz [93] (27.0 dBm)
			* 6435.0 MHz [97] (27.0 dBm)
			* 6455.0 MHz [101] (27.0 dBm)
			* 6475.0 MHz [105] (27.0 dBm)
			* 6495.0 MHz [109] (27.0 dBm)
			* 6515.0 MHz [113] (27.0 dBm)
			* 6535.0 MHz [117] (27.0 dBm)
			* 6555.0 MHz [121] (27.0 dBm)
			* 6575.0 MHz [125] (27.0 dBm)
			* 6595.0 MHz [129] (27.0 dBm)
			* 6615.0 MHz [133] (27.0 dBm)
			* 6635.0 MHz [137] (27.0 dBm)
			* 6655.0 MHz [141] (27.0 dBm)
			* 6675.0 MHz [145] (27.0 dBm)
			* 6695.0 MHz [149] (27.0 dBm)
			* 6715.0 MHz [153] (27.0 dBm)
			* 6735.0 MHz [157] (27.0 dBm)
			* 6755.0 MHz [161] (27.0 dBm)
			* 6775.0 MHz [165] (27.0 dBm)
			* 6795.0 MHz [169] (27.0 dBm)
			* 6815.0 MHz [173] (27.0 dBm)
			* 6835.0 MHz [177] (27.0 dBm)
			* 6855.0 MHz [181] (27.0 dBm)
			* 6875.0 MHz [185] (27.0 dBm)
			* 6895.0 MHz [189] (27.0 dBm)
			* 6915.0 MHz [193] (27.0 dBm)
			* 6935.0 MHz [197] (27.0 dBm)
			* 6955.0 MHz [201] (27.0 dBm)
			* 6975.0 MHz [205] (27.0 dBm)
			* 6995.0 MHz [209] (27.0 dBm)
			* 7015.0 MHz [213] (27.0 dBm)
			* 7035.0 MHz [217] (27.0 dBm)
			* 7055.0 MHz [221] (27.0 dBm)
			* 7075.0 MHz [225] (27.0 dBm)
			* 7095.0 MHz [229] (27.0 dBm)
			* 7115.0 MHz [233] (27.0 dBm)
			* 5935.0 MHz [2] (disabled)
	valid interface combinations:
		 * #{ managed } <= 1, #{ AP, mesh point } <= 16,
		   total <= 16, #channels <= 1, STA/AP BI must match, radar detect widths: { 20 MHz (no HT), 20 MHz, 40 MHz, 80 MHz, 80+80 MHz, 160 MHz }

	HT Capability overrides:
		 * MCS: ff ff ff ff ff ff ff ff ff ff
		 * maximum A-MSDU length
		 * supported channel width
		 * short GI for 40 MHz
		 * max A-MPDU length exponent
		 * min MPDU start spacing
	max # scan plans: 1
	max scan plan interval: -1
	max scan plan iterations: 0
	Maximum associated stations in AP mode: 128
	Supported extended features:
		* [ RRM ]: RRM
		* [ SET_SCAN_DWELL ]: scan dwell setting
		* [ FILS_STA ]: STA FILS (Fast Initial Link Setup)
		* [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
		* [ CONTROL_PORT_OVER_NL80211 ]: control port over nl80211
		* [ ACK_SIGNAL_SUPPORT ]: ack signal level support
		* [ TXQS ]: FQ-CoDel-enabled intermediate TXQs
		* [ ENABLE_FTM_RESPONDER ]: enable FTM (Fine Time Measurement) responder
		* [ STA_TX_PWR ]: TX power control per station
		* [ CONTROL_PORT_NO_PREAUTH ]: disable pre-auth over nl80211 control port support
		* [ SCAN_FREQ_KHZ ]: scan on kHz frequency support
		* [ CONTROL_PORT_OVER_NL80211_TX_STATUS ]: tx status for nl80211 control port support
		* [ FILS_DISCOVERY ]: FILS discovery frame transmission support
		* [ UNSOL_BCAST_PROBE_RESP ]: unsolicated broadcast probe response transmission support
		* [ BSS_COLOR ]: BSS coloring support
		* [ POWERED_ADDR_CHANGE ]: can change MAC address while up
root@OpenWrt:~# iw dev
phy#1
	Interface phy1-ap0
		ifindex 5
		wdev 0x100000001
		addr c4:93:00:3a:35:0f
		ssid OpenWrt
		type AP
		channel 5 (5975 MHz), width: 80 MHz, center1: 5985 MHz
		txpower 18.00 dBm
		multicast TXQ:
			qsz-byt	qsz-pkt	flows	drops	marks	overlmt	hashcoltx-bytes	tx-packets
			0	0	35	0	0	0	0	5324		35
root@OpenWrt:~# iwinfo phy1-ap0 txpowerlist
 255 dBm (2147483647 mW)