diff --git a/recipes-wifi/linux-mac80211/files/config b/recipes-wifi/linux-mac80211/files/config
index 676058a..b3d8eab 100644
--- a/recipes-wifi/linux-mac80211/files/config
+++ b/recipes-wifi/linux-mac80211/files/config
@@ -16,3 +16,5 @@
 CPTCFG_MAC80211_MLME_DEBUG=y
 CPTCFG_MAC80211_STA_DEBUG=y
 CPTCFG_MAC80211_HT_DEBUG=y
+CPTCFG_MAC80211_PS_DEBUG=y
+CPTCFG_MAC80211_DEBUG_COUNTERS=y
diff --git a/recipes-wifi/linux-mt76/files/patches/0013-wifi-mt76-mt7915-limit-per-band-token-count.patch b/recipes-wifi/linux-mt76/files/patches/0013-wifi-mt76-mt7915-limit-per-band-token-count.patch
index 04f4bae..ee848e6 100644
--- a/recipes-wifi/linux-mt76/files/patches/0013-wifi-mt76-mt7915-limit-per-band-token-count.patch
+++ b/recipes-wifi/linux-mt76/files/patches/0013-wifi-mt76-mt7915-limit-per-band-token-count.patch
@@ -1,25 +1,15 @@
-From 6c1136f7cdafe9cd4a6517afa60227f5ffa86b0a Mon Sep 17 00:00:00 2001
+From ef9b267adeee3803ae8ee3073d2ebcbd3e1c95f9 Mon Sep 17 00:00:00 2001
 From: Peter Chiu <chui-hao.chiu@mediatek.com>
 Date: Mon, 29 Jan 2024 15:33:24 +0800
-Subject: [PATCH 13/14] wifi: mt76: mt7915: limit per-band token count
+Subject: [PATCH] wifi: mt76: mt7915: limit per-band token count
 
 Add a threshold for per-band token count to prevent a band from interfering
 with the other band.
 
 Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
----
- mt76.h           |  8 +++++++-
- mt7915/init.c    |  3 +++
- mt7915/mac.c     |  3 ++-
- mt7921/pci_mac.c |  2 +-
- mt7925/pci_mac.c |  2 +-
- mt7996/init.c    |  5 +++++
- mt7996/mac.c     |  3 ++-
- tx.c             | 20 ++++++++++++++++++--
- 8 files changed, 39 insertions(+), 7 deletions(-)
 
 diff --git a/mt76.h b/mt76.h
-index ee14425..b83456b 100644
+index ee14425d..b83456b4 100644
 --- a/mt76.h
 +++ b/mt76.h
 @@ -407,6 +407,8 @@ struct mt76_txwi_cache {
@@ -58,8 +48,21 @@
  void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
  struct mt76_txwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
  int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
+diff --git a/mt76_connac_mac.c b/mt76_connac_mac.c
+index 630c6402..a92c261d 100644
+--- a/mt76_connac_mac.c
++++ b/mt76_connac_mac.c
+@@ -1178,6 +1178,8 @@ void mt76_connac2_tx_token_put(struct mt76_dev *dev)
+ 	idr_for_each_entry(&dev->token, txwi, id) {
+ 		mt76_connac2_txwi_free(dev, txwi, NULL, NULL);
+ 		dev->token_count--;
++		if (dev->num_phy > 1 && dev->phys[txwi->phy_idx])
++			dev->phys[txwi->phy_idx]->tokens--;
+ 	}
+ 	spin_unlock_bh(&dev->token_lock);
+ 	idr_destroy(&dev->token);
 diff --git a/mt7915/init.c b/mt7915/init.c
-index f81a2f2..3ec9eab 100644
+index f81a2f2f..3ec9eab7 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -1225,6 +1225,8 @@ int mt7915_register_device(struct mt7915_dev *dev)
@@ -80,7 +83,7 @@
  	ret = mt7915_init_debugfs(&dev->phy);
  	if (ret)
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index a5d0b09..4604a68 100644
+index a5d0b096..4604a682 100644
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
 @@ -738,6 +738,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -101,7 +104,7 @@
  		return id;
  
 diff --git a/mt7921/pci_mac.c b/mt7921/pci_mac.c
-index 031ba9a..4c69c55 100644
+index 031ba9aa..4c69c55c 100644
 --- a/mt7921/pci_mac.c
 +++ b/mt7921/pci_mac.c
 @@ -27,7 +27,7 @@ int mt7921e_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -114,7 +117,7 @@
  		return id;
  
 diff --git a/mt7925/pci_mac.c b/mt7925/pci_mac.c
-index 9fca887..f1d615c 100644
+index 9fca8879..f1d615c0 100644
 --- a/mt7925/pci_mac.c
 +++ b/mt7925/pci_mac.c
 @@ -27,7 +27,7 @@ int mt7925e_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -127,7 +130,7 @@
  		return id;
  
 diff --git a/mt7996/init.c b/mt7996/init.c
-index 9aa97e4..7549a10 100644
+index 9aa97e4a..7549a108 100644
 --- a/mt7996/init.c
 +++ b/mt7996/init.c
 @@ -634,6 +634,8 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
@@ -157,7 +160,7 @@
  	if (ret)
  		goto error;
 diff --git a/mt7996/mac.c b/mt7996/mac.c
-index bc7111a..aa19120 100644
+index bc7111a7..aa19120b 100644
 --- a/mt7996/mac.c
 +++ b/mt7996/mac.c
 @@ -922,6 +922,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
@@ -178,7 +181,7 @@
  		return id;
  
 diff --git a/tx.c b/tx.c
-index ab42f69..0fdf7d8 100644
+index ab42f69b..0fdf7d83 100644
 --- a/tx.c
 +++ b/tx.c
 @@ -825,16 +825,30 @@ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
diff --git a/recipes-wifi/linux-mt76/files/patches/0016-wifi-mt76-mt7915-add-dummy-HW-offload-of-IEEE-802.11.patch b/recipes-wifi/linux-mt76/files/patches/0016-wifi-mt76-mt7915-add-dummy-HW-offload-of-IEEE-802.11.patch
new file mode 100644
index 0000000..ac40da9
--- /dev/null
+++ b/recipes-wifi/linux-mt76/files/patches/0016-wifi-mt76-mt7915-add-dummy-HW-offload-of-IEEE-802.11.patch
@@ -0,0 +1,55 @@
+From 239f1a1bb8eedd9f24dd3abcb801dceac7fe7ffb Mon Sep 17 00:00:00 2001
+From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+Date: Wed, 17 Apr 2024 10:47:08 +0800
+Subject: [PATCH] wifi: mt76: mt7915: add dummy HW offload of IEEE 802.11
+ fragmentation
+
+Currently, CONNAC2 series do not support encryption for fragmented Tx frames.
+Therefore, add dummy function mt7915_set_frag_threshold() to prevent SW IEEE 802.11 fragmentation.
+
+Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+---
+ mt7915/init.c | 1 +
+ mt7915/main.c | 7 +++++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/mt7915/init.c b/mt7915/init.c
+index 3ec9eab..19a68c5 100644
+--- a/mt7915/init.c
++++ b/mt7915/init.c
+@@ -398,6 +398,7 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
+ 	ieee80211_hw_set(hw, SUPPORTS_RX_DECAP_OFFLOAD);
+ 	ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
+ 	ieee80211_hw_set(hw, WANT_MONITOR_VIF);
++	ieee80211_hw_set(hw, SUPPORTS_TX_FRAG);
+ 
+ 	hw->max_tx_fragments = 4;
+ 
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 9eeca39..5224d83 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -1614,6 +1614,12 @@ mt7915_twt_teardown_request(struct ieee80211_hw *hw,
+ 	mutex_unlock(&dev->mt76.mutex);
+ }
+ 
++static int
++mt7915_set_frag_threshold(struct ieee80211_hw *hw, u32 val)
++{
++	return -EOPNOTSUPP;
++}
++
+ static int
+ mt7915_set_radar_background(struct ieee80211_hw *hw,
+ 			    struct cfg80211_chan_def *chandef)
+@@ -1741,6 +1747,7 @@ const struct ieee80211_ops mt7915_ops = {
+ 	.sta_set_decap_offload = mt7915_sta_set_decap_offload,
+ 	.add_twt_setup = mt7915_mac_add_twt_setup,
+ 	.twt_teardown_request = mt7915_twt_teardown_request,
++	.set_frag_threshold = mt7915_set_frag_threshold,
+ 	CFG80211_TESTMODE_CMD(mt76_testmode_cmd)
+ 	CFG80211_TESTMODE_DUMP(mt76_testmode_dump)
+ #ifdef CONFIG_MAC80211_DEBUGFS
+-- 
+2.18.0
+
diff --git a/recipes-wifi/linux-mt76/files/patches/1022-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch b/recipes-wifi/linux-mt76/files/patches/1022-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch
index a5e4621..9030b99 100644
--- a/recipes-wifi/linux-mt76/files/patches/1022-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1022-wifi-mt76-mt7915-add-bf-backoff-limit-table-support.patch
@@ -1,13 +1,12 @@
-From 5f739478e44b2cb080b0ece69b06dd18280e8d3e Mon Sep 17 00:00:00 2001
+From ff7ce1171852dedcaec49ea0de398dfea04aaced Mon Sep 17 00:00:00 2001
 From: Shayne Chen <shayne.chen@mediatek.com>
 Date: Mon, 5 Dec 2022 18:21:51 +0800
-Subject: [PATCH 1022/1053] wifi: mt76: mt7915: add bf backoff limit table
- support
+Subject: [PATCH] wifi: mt76: mt7915: add bf backoff limit table support
 
 Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
 ---
  debugfs.c        |   4 +-
- eeprom.c         |  43 ++++++++++--
+ eeprom.c         |  38 ++++++++--
  mt76.h           |   8 +++
  mt7915/debugfs.c |  73 +++++++++++++++++--
  mt7915/init.c    |   7 ++
@@ -15,7 +14,7 @@
  mt7915/mcu.c     | 178 +++++++++++++++++++++++++++++++++++++----------
  mt7915/mcu.h     |   6 ++
  mt7915/mt7915.h  |   9 ++-
- 9 files changed, 279 insertions(+), 55 deletions(-)
+ 9 files changed, 275 insertions(+), 54 deletions(-)
 
 diff --git a/debugfs.c b/debugfs.c
 index 1c8328d..a626f7c 100644
@@ -34,7 +33,7 @@
  }
  EXPORT_SYMBOL_GPL(mt76_seq_puts_array);
 diff --git a/eeprom.c b/eeprom.c
-index 9d029c0..4213e44 100644
+index 9d029c0..aa33e7b 100644
 --- a/eeprom.c
 +++ b/eeprom.c
 @@ -336,9 +336,10 @@ mt76_apply_array_limit(s8 *pwr, size_t pwr_len, const __be32 *data,
@@ -76,7 +75,7 @@
  
  	if (!IS_ENABLED(CONFIG_OF))
  		return target_power;
-@@ -428,14 +433,40 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
+@@ -428,12 +433,35 @@ s8 mt76_get_rate_power_limits(struct mt76_phy *phy,
  	val = mt76_get_of_array(np, "rates-mcs", &len, mcs_rates + 1);
  	mt76_apply_multi_array_limit(dest->mcs[0], ARRAY_SIZE(dest->mcs[0]),
  				     ARRAY_SIZE(dest->mcs), val, len,
@@ -88,8 +87,7 @@
  				     ARRAY_SIZE(dest->ru), val, len,
 -				     target_power, txs_delta, &max_power);
 +				     target_power, txs_delta);
- 
--	return max_power;
++
 +	max_power_backoff = max_power;
 +	val = mt76_get_of_array(np, "paths-cck", &len, ARRAY_SIZE(dest->path.cck));
 +	mt76_apply_array_limit(dest->path.cck, ARRAY_SIZE(dest->path.cck), val,
@@ -112,14 +110,9 @@
 +	mt76_apply_multi_array_limit(dest->path.ru_bf[0], ARRAY_SIZE(dest->path.ru_bf[0]),
 +				     ARRAY_SIZE(dest->path.ru_bf), val, len,
 +				     target_power_combine, txs_delta);
-+
-+	if (max_power_backoff == target_power_combine)
-+		return max_power;
-+
-+	return max_power_backoff;
- }
- EXPORT_SYMBOL_GPL(mt76_get_rate_power_limits);
  
+ 	return max_power;
+ }
 diff --git a/mt76.h b/mt76.h
 index 48e98a3..5c26715 100644
 --- a/mt76.h
diff --git a/recipes-wifi/linux-mt76/files/patches/1034-wifi-mt76-mt7915-enable-the-mac80211-hw-bmc-ps-buffe.patch b/recipes-wifi/linux-mt76/files/patches/1034-wifi-mt76-mt7915-enable-the-mac80211-hw-bmc-ps-buffe.patch
index c33652c..8467fb7 100644
--- a/recipes-wifi/linux-mt76/files/patches/1034-wifi-mt76-mt7915-enable-the-mac80211-hw-bmc-ps-buffe.patch
+++ b/recipes-wifi/linux-mt76/files/patches/1034-wifi-mt76-mt7915-enable-the-mac80211-hw-bmc-ps-buffe.patch
@@ -1,15 +1,15 @@
-From 5476b7efd643f968654047541d718a3c07b1a389 Mon Sep 17 00:00:00 2001
+From 20c497b434dc4555210ea64cde38dd86817d8891 Mon Sep 17 00:00:00 2001
 From: Evelyn Tsai <evelyn.tsai@mediatek.com>
 Date: Thu, 24 Aug 2023 03:01:27 +0800
-Subject: [PATCH 1034/1053] wifi: mt76: mt7915: enable the mac80211 hw bmc ps
- buffer function.
+Subject: [PATCH] wifi: mt76: mt7915: enable the mac80211 hw bmc ps buffer
+ function.
 
 ---
  mt7915/init.c | 1 +
  1 file changed, 1 insertion(+)
 
 diff --git a/mt7915/init.c b/mt7915/init.c
-index a5b38c8..b2e613c 100644
+index 35aefca..545afe7 100644
 --- a/mt7915/init.c
 +++ b/mt7915/init.c
 @@ -413,6 +413,7 @@ mt7915_init_wiphy(struct mt7915_phy *phy)
@@ -17,9 +17,9 @@
  	ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
  	ieee80211_hw_set(hw, WANT_MONITOR_VIF);
 +	ieee80211_hw_set(hw, HOST_BROADCAST_PS_BUFFERING);
+ 	ieee80211_hw_set(hw, SUPPORTS_TX_FRAG);
  
  	hw->max_tx_fragments = 4;
- 
 -- 
 2.18.0
 
diff --git a/recipes-wifi/linux-mt76/files/patches/patches.inc b/recipes-wifi/linux-mt76/files/patches/patches.inc
index 4dacca4..eca405a 100644
--- a/recipes-wifi/linux-mt76/files/patches/patches.inc
+++ b/recipes-wifi/linux-mt76/files/patches/patches.inc
@@ -15,6 +15,7 @@
     file://0013-wifi-mt76-mt7915-limit-per-band-token-count.patch \
     file://0014-wifi-mt76-mt7915-update-power-on-sequence.patch \
     file://0015-wifi-mt76-mt7915-add-support-for-IEEE-802.11-fragmen.patch \
+    file://0016-wifi-mt76-mt7915-add-dummy-HW-offload-of-IEEE-802.11.patch \
     file://0016-wifi-mt76-mt7915-fix-rx-filter-setting-for-bfee-func.patch \
     file://0999-wifi-mt76-mt7915-build-pass-for-Linux-Kernel-5.4-fix.patch \
     file://1000-wifi-mt76-mt7915-add-mtk-internal-debug-tools-for-mt.patch \