rt2800-soc is used for 2.4GHz in miwifi-mini, and it depends on mac80211 so it's SoftMAC, isn't it?
Can hardware make a limitation for SoftMAC?
How to check this limitation?
mt76 is used for 5GHz on miwifi-mini. I can modify 5GHz mac significantly. But can not set fa:de:ad:c0:de:01 and fa:de:ad:c0:de:02 for two 5GHz interfaces bridged together, but I can set fa:de:ad:c0:de:01 and fe:de:ad:c0:de:01 (ie last part must be equal)
The mt76 driver (and others) imposes restrictions on which BSSIDs can be set.
Theoretically one should be able to query /sys/class/ieee80211/phyX/address_mask and /sys/class/ieee80211/phyX/addresses to query the BSSID restrictions but it appears as if mt76 does not properly populate these.
According to another dev I asked, it is a hardware limitation. The hardware uses a bit field internally to track the used BSSIDs. Due to that, it is only possible to set BSSIDs in the range phy base address .. phy base address + 16. So in practice you can only use /sys/class/ieee80211/phy0/macaddress and 16 subsequent BSSIDs.