diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
index 8c33c0f..f6cca71 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3003-mt76-connac-wed-add-wed-rx-copy-skb.patch
@@ -1,15 +1,15 @@
-From 0f7a824cab3692fe35f73f6d11e788619e02193f Mon Sep 17 00:00:00 2001
+From cf9c84fbe7863a9af60e00bbb18ebdc6a4f29020 Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Thu, 5 Jan 2023 16:43:57 +0800
 Subject: [PATCH 3003/3014] mt76: connac: wed: add wed rx copy skb
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
- dma.c | 51 ++++++++++++++++++++++++++++++++++++++++-----------
- 1 file changed, 40 insertions(+), 11 deletions(-)
+ dma.c | 67 ++++++++++++++++++++++++++++++++++++++++++++++-------------
+ 1 file changed, 52 insertions(+), 15 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index f977b7f5..1082d6f1 100644
+index e05b7ca1..74e2169e 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -207,11 +207,11 @@ mt76_dma_queue_reset(struct mt76_dev *dev, struct mt76_queue *q)
@@ -41,53 +41,75 @@
  
  		rx_token = mt76_rx_token_consume(dev, data, txwi, buf->addr);
  		if (rx_token < 0) {
-@@ -406,6 +408,7 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
- 		u32 token = FIELD_GET(MT_DMA_CTL_TOKEN,
- 				      le32_to_cpu(desc->buf1));
- 		struct mt76_txwi_cache *t = mt76_rx_token_release(dev, token);
-+		struct mt76_queue_buf qbuf;
+@@ -386,7 +388,7 @@ mt76_dma_tx_cleanup(struct mt76_dev *dev, struct mt76_queue *q, bool flush)
  
- 		if (!t)
- 			return NULL;
-@@ -414,11 +417,33 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+ static void *
+ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+-		 int *len, u32 *info, bool *more, bool *drop)
++		 int *len, u32 *info, bool *more, bool *drop, bool flush)
+ {
+ 	struct mt76_queue_entry *e = &q->entry[idx];
+ 	struct mt76_desc *desc = &q->desc[idx];
+@@ -413,12 +415,43 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+ 		dma_unmap_single(dev->dma_dev, t->dma_addr,
  				 SKB_WITH_OVERHEAD(q->buf_size),
  				 DMA_FROM_DEVICE);
- 
+-
 -		buf = t->ptr;
 -		t->dma_addr = 0;
 -		t->ptr = NULL;
-+		buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
-+		if (!buf)
-+			return NULL;
-+
-+		memcpy(buf, t->ptr, SKB_WITH_OVERHEAD(q->buf_size));
+-
+-		mt76_put_rxwi(dev, t);
++		if (flush) {
++			buf = t->ptr;
++			t->dma_addr = 0;
++			t->ptr = NULL;
 +
-+		t->dma_addr = dma_map_single(dev->dma_dev, t->ptr,
-+					     SKB_WITH_OVERHEAD(q->buf_size),
-+					     DMA_FROM_DEVICE);
-+		if (unlikely(dma_mapping_error(dev->dma_dev, t->dma_addr))) {
-+			skb_free_frag(t->ptr);
 +			mt76_put_rxwi(dev, t);
-+			return NULL;
-+		}
++		} else {
++			struct mt76_queue_buf qbuf;
 +
-+		qbuf.addr = t->dma_addr;
-+		qbuf.len = SKB_WITH_OVERHEAD(q->buf_size);
-+		qbuf.skip_unmap = false;
- 
--		mt76_put_rxwi(dev, t);
-+		if (mt76_dma_add_rx_buf(dev, q, &qbuf, t->ptr, t) < 0) {
-+			dma_unmap_single(dev->dma_dev, t->dma_addr,
-+					 SKB_WITH_OVERHEAD(q->buf_size),
-+					 DMA_FROM_DEVICE);
-+			skb_free_frag(t->ptr);
-+			mt76_put_rxwi(dev, t);
-+			return NULL;
++			buf = page_frag_alloc(&q->rx_page, q->buf_size, GFP_ATOMIC);
++			if (!buf)
++				return NULL;
++
++			memcpy(buf, t->ptr, SKB_WITH_OVERHEAD(q->buf_size));
++
++			t->dma_addr = dma_map_single(dev->dma_dev, t->ptr,
++						     SKB_WITH_OVERHEAD(q->buf_size),
++						     DMA_FROM_DEVICE);
++			if (unlikely(dma_mapping_error(dev->dma_dev, t->dma_addr))) {
++				skb_free_frag(t->ptr);
++				mt76_put_rxwi(dev, t);
++				return NULL;
++			}
++
++			qbuf.addr = t->dma_addr;
++			qbuf.len = SKB_WITH_OVERHEAD(q->buf_size);
++			qbuf.skip_unmap = false;
++
++			if (mt76_dma_add_rx_buf(dev, q, &qbuf, t->ptr, t) < 0) {
++				dma_unmap_single(dev->dma_dev, t->dma_addr,
++						 SKB_WITH_OVERHEAD(q->buf_size),
++						 DMA_FROM_DEVICE);
++				skb_free_frag(t->ptr);
++				mt76_put_rxwi(dev, t);
++				return NULL;
++			}
 +		}
  
  		if (drop) {
  			u32 ctrl = le32_to_cpu(READ_ONCE(desc->ctrl));
-@@ -587,6 +612,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -455,7 +488,7 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
+ 	q->tail = (q->tail + 1) % q->ndesc;
+ 	q->queued--;
+ 
+-	return mt76_dma_get_buf(dev, q, idx, len, info, more, drop);
++	return mt76_dma_get_buf(dev, q, idx, len, info, more, drop, flush);
+ }
+ 
+ static int
+@@ -587,6 +620,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  	int len = SKB_WITH_OVERHEAD(q->buf_size);
  	int frames = 0, offset = q->buf_offset;
  	dma_addr_t addr;
@@ -95,7 +117,7 @@
  
  	if (!q->ndesc)
  		return 0;
-@@ -610,7 +636,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -610,7 +644,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  		qbuf.addr = addr + offset;
  		qbuf.len = len - offset;
  		qbuf.skip_unmap = false;
@@ -104,7 +126,7 @@
  			dma_unmap_single(dev->dma_dev, addr, len,
  					 DMA_FROM_DEVICE);
  			skb_free_frag(buf);
-@@ -619,7 +645,10 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -619,7 +653,10 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
  		frames++;
  	}
  
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
index 28db7a8..d5fca9a 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3005-mt76-mt7915-wed-add-ser-support-when-wed-on.patch
@@ -57,7 +57,7 @@
  	if (!mtk_wed_device_active(wed))
  		q->flags &= ~MT_QFLAG_WED;
  
-@@ -675,7 +680,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -683,7 +688,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
  
  	switch (type) {
  	case MT76_WED_Q_TX:
@@ -66,7 +66,7 @@
  		if (!ret)
  			q->wed_regs = wed->tx_ring[ring].reg_base;
  		break;
-@@ -691,7 +696,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -699,7 +704,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
  			q->wed_regs = wed->txfree_ring.reg_base;
  		break;
  	case MT76_WED_Q_RX:
@@ -75,7 +75,7 @@
  		if (!ret)
  			q->wed_regs = wed->rx_ring[ring].reg_base;
  		break;
-@@ -704,6 +709,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -712,6 +717,7 @@ mt76_dma_wed_setup(struct mt76_dev *dev, struct mt76_queue *q)
  	return 0;
  #endif
  }
@@ -83,7 +83,7 @@
  
  static int
  mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
-@@ -730,7 +736,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -738,7 +744,7 @@ mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,
  	if (!q->entry)
  		return -ENOMEM;
  
@@ -92,7 +92,7 @@
  	if (ret)
  		return ret;
  
-@@ -781,8 +787,13 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
+@@ -789,8 +795,13 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid)
  		q->desc[i].ctrl = cpu_to_le32(MT_DMA_CTL_DMA_DONE);
  
  	mt76_dma_rx_cleanup(dev, q);
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
index df64e4d..3798866 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3006-mt76-mt7915-wed-enable-red-per-band-token-drop-for-H.patch
@@ -40,7 +40,7 @@
 index f494d9f6..116a5cc9 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -2376,6 +2376,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2377,6 +2377,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  			return ret;
  	}
  
@@ -48,7 +48,7 @@
  	ret = mt7915_mcu_set_mwds(dev, 1);
  	if (ret)
  		return ret;
-@@ -2389,8 +2390,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
+@@ -2390,8 +2391,7 @@ int mt7915_mcu_init_firmware(struct mt7915_dev *dev)
  	if (ret)
  		return ret;
  
@@ -58,7 +58,7 @@
  }
  
  int mt7915_mcu_init(struct mt7915_dev *dev)
-@@ -4533,27 +4533,58 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
+@@ -4534,27 +4534,58 @@ int mt7915_dbg_mcu_wa_cmd(struct mt7915_dev *dev, int cmd, u32 a1, u32 a2, u32 a
  
  	return mt76_mcu_send_msg(&dev->mt76, cmd, &req, sizeof(req), wait_resp);
  }
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3007-mt76-mt7915-wed-find-rx-token-by-physical-address.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3007-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
index 35d9a77..bcdd37a 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3007-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3007-mt76-mt7915-wed-find-rx-token-by-physical-address.patch
@@ -16,7 +16,7 @@
 index 5163a8e9..0dce97fb 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -406,11 +406,30 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -406,10 +406,29 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  
  	if ((q->flags & MT_QFLAG_WED) &&
  	    FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
@@ -25,8 +25,7 @@
  				      le32_to_cpu(desc->buf1));
 -		struct mt76_txwi_cache *t = mt76_rx_token_release(dev, token);
 +		struct mt76_txwi_cache *t;
- 		struct mt76_queue_buf qbuf;
- 
++
 +		if (*more) {
 +			spin_lock_bh(&dev->rx_token_lock);
 +
@@ -43,7 +42,7 @@
 +			if (!find)
 +				return NULL;
 +		}
-+
+ 
 +		t = mt76_rx_token_release(dev, token);
  		if (!t)
  			return NULL;
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3008-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3008-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
index 4616fdd..a1c51c0 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3008-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3008-mt76-mt7915-wed-drop-scatter-and-gather-frame.patch
@@ -17,7 +17,7 @@
 index 0dce97fb..98d2a29a 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -470,6 +470,15 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -478,6 +478,15 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  
  			*drop = !!(ctrl & (MT_DMA_CTL_TO_HOST_A |
  					   MT_DMA_CTL_DROP));
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3009-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3009-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
index c9f2a59..777a5a8 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3009-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3009-mt76-mt7915-wed-HW-ATF-support-for-mt7986.patch
@@ -579,7 +579,7 @@
 index 116a5cc9..15f20add 100644
 --- a/mt7915/mcu.c
 +++ b/mt7915/mcu.c
-@@ -3529,6 +3529,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
+@@ -3530,6 +3530,171 @@ int mt7915_mcu_set_ser(struct mt7915_dev *dev, u8 action, u8 set, u8 band)
  				 &req, sizeof(req), false);
  }
  
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3011-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3011-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch
index bac87e6..8f063a0 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3011-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3011-mt76-mt7915-wed-add-rxwi-for-further-in-chip-rro-dev.patch
@@ -1,21 +1,21 @@
-From dc6f151a8420ce5569b1db103525543600b2f9b5 Mon Sep 17 00:00:00 2001
+From 0ed439e39989e3bd470c2aac9e07ab23853d76ed Mon Sep 17 00:00:00 2001
 From: Sujuan Chen <sujuan.chen@mediatek.com>
 Date: Fri, 6 Jan 2023 18:18:50 +0800
 Subject: [PATCH 3011/3014] mt76: mt7915: wed: add rxwi for further in chip rro
 
 Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
 ---
- dma.c           | 107 ++++++++++++++++++++++++------------------------
+ dma.c           | 115 ++++++++++++++++++++++++------------------------
  mac80211.c      |   2 +-
- mt76.h          |  24 +++++++----
+ mt76.h          |  24 ++++++----
  mt7915/dma.c    |   2 -
- mt7915/mmio.c   |  21 +++++-----
+ mt7915/mmio.c   |  21 ++++-----
  mt7915/mt7915.h |   1 +
- tx.c            |  16 ++++----
- 7 files changed, 90 insertions(+), 83 deletions(-)
+ tx.c            |  16 +++----
+ 7 files changed, 94 insertions(+), 87 deletions(-)
 
 diff --git a/dma.c b/dma.c
-index 98d2a29a..21f26df7 100644
+index f898cef0..d4fc091e 100644
 --- a/dma.c
 +++ b/dma.c
 @@ -59,17 +59,17 @@ mt76_alloc_txwi(struct mt76_dev *dev)
@@ -183,13 +183,12 @@
  	q->entry[idx].skb = skb;
  	q->entry[idx].wcid = 0xffff;
  
-@@ -409,14 +410,14 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -409,13 +410,13 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  		u32 id, find = 0;
  		u32 token = FIELD_GET(MT_DMA_CTL_TOKEN,
  				      le32_to_cpu(desc->buf1));
 -		struct mt76_txwi_cache *t;
 +		struct mt76_rxwi_cache *r;
- 		struct mt76_queue_buf qbuf;
  
  		if (*more) {
  			spin_lock_bh(&dev->rx_token_lock);
@@ -201,7 +200,7 @@
  					find = 1;
  					desc->buf1 = FIELD_PREP(MT_DMA_CTL_TOKEN, id);
  					token = id;
-@@ -429,11 +430,11 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+@@ -428,19 +429,19 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
  				return NULL;
  		}
  
@@ -215,46 +214,58 @@
 +		dma_unmap_single(dev->dma_dev, r->dma_addr,
  				 SKB_WITH_OVERHEAD(q->buf_size),
  				 DMA_FROM_DEVICE);
+ 		if (flush) {
+-			buf = t->ptr;
+-			t->dma_addr = 0;
+-			t->ptr = NULL;
++			buf = r->ptr;
++			r->dma_addr = 0;
++			r->ptr = NULL;
  
-@@ -441,27 +442,27 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
- 		if (!buf)
- 			return NULL;
- 
--		memcpy(buf, t->ptr, SKB_WITH_OVERHEAD(q->buf_size));
-+		memcpy(buf, r->ptr, SKB_WITH_OVERHEAD(q->buf_size));
- 
--		t->dma_addr = dma_map_single(dev->dma_dev, t->ptr,
-+		r->dma_addr = dma_map_single(dev->dma_dev, r->ptr,
- 					     SKB_WITH_OVERHEAD(q->buf_size),
- 					     DMA_FROM_DEVICE);
--		if (unlikely(dma_mapping_error(dev->dma_dev, t->dma_addr))) {
--			skb_free_frag(t->ptr);
 -			mt76_put_rxwi(dev, t);
-+		if (unlikely(dma_mapping_error(dev->dma_dev, r->dma_addr))) {
-+			skb_free_frag(r->ptr);
 +			mt76_put_rxwi(dev, r);
- 			return NULL;
- 		}
+ 		} else {
+ 			struct mt76_queue_buf qbuf;
  
--		qbuf.addr = t->dma_addr;
-+		qbuf.addr = r->dma_addr;
- 		qbuf.len = SKB_WITH_OVERHEAD(q->buf_size);
- 		qbuf.skip_unmap = false;
+@@ -448,27 +449,27 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+ 			if (!buf)
+ 				return NULL;
  
--		if (mt76_dma_add_rx_buf(dev, q, &qbuf, t->ptr, t) < 0) {
--			dma_unmap_single(dev->dma_dev, t->dma_addr,
-+		if (mt76_dma_add_rx_buf(dev, q, &qbuf, r->ptr, r) < 0) {
-+			dma_unmap_single(dev->dma_dev, r->dma_addr,
- 					 SKB_WITH_OVERHEAD(q->buf_size),
- 					 DMA_FROM_DEVICE);
--			skb_free_frag(t->ptr);
--			mt76_put_rxwi(dev, t);
-+			skb_free_frag(r->ptr);
-+			mt76_put_rxwi(dev, r);
- 			return NULL;
- 		}
+-			memcpy(buf, t->ptr, SKB_WITH_OVERHEAD(q->buf_size));
++			memcpy(buf, r->ptr, SKB_WITH_OVERHEAD(q->buf_size));
  
-@@ -531,7 +532,7 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
+-			t->dma_addr = dma_map_single(dev->dma_dev, t->ptr,
++			r->dma_addr = dma_map_single(dev->dma_dev, r->ptr,
+ 						     SKB_WITH_OVERHEAD(q->buf_size),
+ 						     DMA_FROM_DEVICE);
+-			if (unlikely(dma_mapping_error(dev->dma_dev, t->dma_addr))) {
+-				skb_free_frag(t->ptr);
+-				mt76_put_rxwi(dev, t);
++			if (unlikely(dma_mapping_error(dev->dma_dev, r->dma_addr))) {
++				skb_free_frag(r->ptr);
++				mt76_put_rxwi(dev, r);
+ 				return NULL;
+ 			}
+ 
+-			qbuf.addr = t->dma_addr;
++			qbuf.addr = r->dma_addr;
+ 			qbuf.len = SKB_WITH_OVERHEAD(q->buf_size);
+ 			qbuf.skip_unmap = false;
+ 
+-			if (mt76_dma_add_rx_buf(dev, q, &qbuf, t->ptr, t) < 0) {
+-				dma_unmap_single(dev->dma_dev, t->dma_addr,
++			if (mt76_dma_add_rx_buf(dev, q, &qbuf, r->ptr, r) < 0) {
++				dma_unmap_single(dev->dma_dev, r->dma_addr,
+ 						 SKB_WITH_OVERHEAD(q->buf_size),
+ 						 DMA_FROM_DEVICE);
+-				skb_free_frag(t->ptr);
+-				mt76_put_rxwi(dev, t);
++				skb_free_frag(r->ptr);
++				mt76_put_rxwi(dev, r);
+ 				return NULL;
+ 			}
+ 		}
+@@ -539,7 +540,7 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
  	buf.len = skb->len;
  
  	spin_lock_bh(&q->lock);
@@ -263,7 +274,7 @@
  	mt76_dma_kick_queue(dev, q);
  	spin_unlock_bh(&q->lock);
  
-@@ -608,7 +609,7 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
+@@ -616,7 +617,7 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
  		goto unmap;
  
  	return mt76_dma_add_buf(dev, q, tx_info.buf, tx_info.nbuf,
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3012-mt76-mt7915-wed-fix-potential-memory-leakage.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3012-mt76-mt7915-wed-fix-potential-memory-leakage.patch
index cdb5320..840f878 100644
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/3012-mt76-mt7915-wed-fix-potential-memory-leakage.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3012-mt76-mt7915-wed-fix-potential-memory-leakage.patch
@@ -16,7 +16,7 @@
 index 21f26df7..cb1fd9c6 100644
 --- a/dma.c
 +++ b/dma.c
-@@ -795,12 +795,14 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+@@ -803,12 +803,14 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
  	} while (1);
  	spin_unlock_bh(&q->lock);