diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0006-mt76-testmode-use-random-payload-for-tx-packets.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0006-mt76-testmode-use-random-payload-for-tx-packets.patch
new file mode 100644
index 0000000..71ac771
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0006-mt76-testmode-use-random-payload-for-tx-packets.patch
@@ -0,0 +1,56 @@
+From df09a1213e5df6e4afd2b1c0e64adfca8f95c72b Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Wed, 6 Jul 2022 21:52:45 +0800
+Subject: [PATCH 6/8] mt76: testmode: use random payload for tx packets
+
+Compared to fixed payload packets, random payload packets have better
+measured EVM under the same txpower. Our tests show EVM becomes at least
+3 dB better in test cases with high rate and long tx length, which also
+aligns the testing result of proprietary driver.
+
+Suggested-by: Jm Chen <jm.chen@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+---
+ testmode.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/testmode.c b/testmode.c
+index ba9ac2d..1d0d5d3 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -1,5 +1,7 @@
+ // SPDX-License-Identifier: ISC
+ /* Copyright (C) 2020 Felix Fietkau <nbd@nbd.name> */
++
++#include <linux/random.h>
+ #include "mt76.h"
+ 
+ const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
+@@ -123,12 +125,14 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+ 	if (!head)
+ 		return -ENOMEM;
+ 
+-	hdr = __skb_put_zero(head, head_len);
++	hdr = __skb_put_zero(head, sizeof(*hdr));
+ 	hdr->frame_control = cpu_to_le16(fc);
+ 	memcpy(hdr->addr1, td->addr[0], ETH_ALEN);
+ 	memcpy(hdr->addr2, td->addr[1], ETH_ALEN);
+ 	memcpy(hdr->addr3, td->addr[2], ETH_ALEN);
+ 	skb_set_queue_mapping(head, IEEE80211_AC_BE);
++	get_random_bytes(__skb_put(head, head_len - sizeof(*hdr)),
++			 head_len - sizeof(*hdr));
+ 
+ 	info = IEEE80211_SKB_CB(head);
+ 	info->flags = IEEE80211_TX_CTL_INJECTED |
+@@ -154,7 +158,7 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len)
+ 			return -ENOMEM;
+ 		}
+ 
+-		__skb_put_zero(frag, frag_len);
++		get_random_bytes(__skb_put(frag, frag_len), frag_len);
+ 		head->len += frag->len;
+ 		head->data_len += frag->len;
+ 
+-- 
+2.18.0
+