diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1008-wifi-mt76-testmode-rework-testmode-init-registers.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1008-wifi-mt76-testmode-rework-testmode-init-registers.patch
new file mode 100644
index 0000000..6bb94e7
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1008-wifi-mt76-testmode-rework-testmode-init-registers.patch
@@ -0,0 +1,479 @@
+From 03aeb960738e8e2cf518c1f88eebb386f650a7c6 Mon Sep 17 00:00:00 2001
+From: Shayne Chen <shayne.chen@mediatek.com>
+Date: Mon, 6 Jun 2022 19:46:26 +0800
+Subject: [PATCH 1008/1034] wifi: mt76: testmode: rework testmode init
+ registers
+
+---
+ mac80211.c        |   3 +-
+ mt76.h            |   5 ++
+ mt76_connac_mcu.h |   1 +
+ mt7915/mcu.h      |   1 +
+ mt7915/mmio.c     |   2 +
+ mt7915/regs.h     |  16 +++++-
+ mt7915/testmode.c | 134 +++++++++++++++++++++++++++++++++++-----------
+ mt7915/testmode.h |  28 ++++++++++
+ testmode.c        |   6 ++-
+ testmode.h        |   3 ++
+ 10 files changed, 164 insertions(+), 35 deletions(-)
+
+diff --git a/mac80211.c b/mac80211.c
+index 76cb08b..4e75e7f 100644
+--- a/mac80211.c
++++ b/mac80211.c
+@@ -787,7 +787,8 @@ void mt76_rx(struct mt76_dev *dev, enum mt76_rxq_id q, struct sk_buff *skb)
+ 	}
+ 
+ #ifdef CONFIG_NL80211_TESTMODE
+-	if (phy->test.state == MT76_TM_STATE_RX_FRAMES) {
++	if (!(phy->test.flag & MT_TM_FW_RX_COUNT) &&
++	    phy->test.state == MT76_TM_STATE_RX_FRAMES) {
+ 		phy->test.rx_stats.packets[q]++;
+ 		if (status->flag & RX_FLAG_FAILED_FCS_CRC)
+ 			phy->test.rx_stats.fcs_error[q]++;
+diff --git a/mt76.h b/mt76.h
+index 35bf19f..c2ad06a 100644
+--- a/mt76.h
++++ b/mt76.h
+@@ -659,6 +659,8 @@ struct mt76_testmode_ops {
+ 	int (*dump_stats)(struct mt76_phy *phy, struct sk_buff *msg);
+ };
+ 
++#define MT_TM_FW_RX_COUNT	BIT(0)
++
+ struct mt76_testmode_data {
+ 	enum mt76_testmode_state state;
+ 
+@@ -690,6 +692,8 @@ struct mt76_testmode_data {
+ 
+ 	u8 addr[3][ETH_ALEN];
+ 
++	u8 flag;
++
+ 	u32 tx_pending;
+ 	u32 tx_queued;
+ 	u16 tx_queued_limit;
+@@ -697,6 +701,7 @@ struct mt76_testmode_data {
+ 	struct {
+ 		u64 packets[__MT_RXQ_MAX];
+ 		u64 fcs_error[__MT_RXQ_MAX];
++		u64 len_mismatch;
+ 	} rx_stats;
+ };
+ 
+diff --git a/mt76_connac_mcu.h b/mt76_connac_mcu.h
+index 7b96feb..92e0b91 100644
+--- a/mt76_connac_mcu.h
++++ b/mt76_connac_mcu.h
+@@ -1193,6 +1193,7 @@ enum {
+ 	MCU_EXT_CMD_OFFCH_SCAN_CTRL = 0x9a,
+ 	MCU_EXT_CMD_SET_RDD_TH = 0x9d,
+ 	MCU_EXT_CMD_MURU_CTRL = 0x9f,
++	MCU_EXT_CMD_RX_STAT = 0xa4,
+ 	MCU_EXT_CMD_SET_SPR = 0xa8,
+ 	MCU_EXT_CMD_GROUP_PRE_CAL_INFO = 0xab,
+ 	MCU_EXT_CMD_DPD_PRE_CAL_INFO = 0xac,
+diff --git a/mt7915/mcu.h b/mt7915/mcu.h
+index 84afa7f..1be6cf3 100644
+--- a/mt7915/mcu.h
++++ b/mt7915/mcu.h
+@@ -9,6 +9,7 @@
+ enum {
+ 	MCU_ATE_SET_TRX = 0x1,
+ 	MCU_ATE_SET_FREQ_OFFSET = 0xa,
++	MCU_ATE_SET_PHY_COUNT = 0x11,
+ 	MCU_ATE_SET_SLOT_TIME = 0x13,
+ 	MCU_ATE_CLEAN_TXQUEUE = 0x1c,
+ };
+diff --git a/mt7915/mmio.c b/mt7915/mmio.c
+index 8d92e76..b23679a 100644
+--- a/mt7915/mmio.c
++++ b/mt7915/mmio.c
+@@ -120,6 +120,7 @@ static const u32 mt7986_reg[] = {
+ };
+ 
+ static const u32 mt7915_offs[] = {
++	[TMAC_TCR2]		= 0x05c,
+ 	[TMAC_CDTR]		= 0x090,
+ 	[TMAC_ODTR]		= 0x094,
+ 	[TMAC_ATCR]		= 0x098,
+@@ -194,6 +195,7 @@ static const u32 mt7915_offs[] = {
+ };
+ 
+ static const u32 mt7916_offs[] = {
++	[TMAC_TCR2]		= 0x004,
+ 	[TMAC_CDTR]		= 0x0c8,
+ 	[TMAC_ODTR]		= 0x0cc,
+ 	[TMAC_ATCR]		= 0x00c,
+diff --git a/mt7915/regs.h b/mt7915/regs.h
+index d01b9ea..038596c 100644
+--- a/mt7915/regs.h
++++ b/mt7915/regs.h
+@@ -48,6 +48,7 @@ enum reg_rev {
+ };
+ 
+ enum offs_rev {
++	TMAC_TCR2,
+ 	TMAC_CDTR,
+ 	TMAC_ODTR,
+ 	TMAC_ATCR,
+@@ -201,6 +202,12 @@ enum offs_rev {
+ #define MT_TRB_RXPSR0_RX_WTBL_PTR	GENMASK(25, 16)
+ #define MT_TRB_RXPSR0_RX_RMAC_PTR	GENMASK(9, 0)
+ 
++#define MT_MDP_TOP_DBG_WDT_CTRL			MT_MDP(0x0d0)
++#define MT_MDP_TOP_DBG_WDT_CTRL_TDP_DIS_BLK	BIT(7)
++
++#define MT_MDP_TOP_DBG_CTRL			MT_MDP(0x0dc)
++#define MT_MDP_TOP_DBG_CTRL_ENQ_MODE		BIT(30)
++
+ /* TMAC: band 0(0x820e4000), band 1(0x820f4000) */
+ #define MT_WF_TMAC_BASE(_band)		((_band) ? 0x820f4000 : 0x820e4000)
+ #define MT_WF_TMAC(_band, ofs)		(MT_WF_TMAC_BASE(_band) + (ofs))
+@@ -209,6 +216,9 @@ enum offs_rev {
+ #define MT_TMAC_TCR0_TX_BLINK		GENMASK(7, 6)
+ #define MT_TMAC_TCR0_TBTT_STOP_CTRL	BIT(25)
+ 
++#define MT_TMAC_TCR2(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_TCR2))
++#define MT_TMAC_TCR2_SCH_DET_DIS	BIT(19)
++
+ #define MT_TMAC_CDTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_CDTR))
+  #define MT_TMAC_ODTR(_band)		MT_WF_TMAC(_band, __OFFS(TMAC_ODTR))
+ #define MT_TIMEOUT_VAL_PLCP		GENMASK(15, 0)
+@@ -488,8 +498,10 @@ enum offs_rev {
+ #define MT_AGG_PCR0_VHT_PROT		BIT(13)
+ #define MT_AGG_PCR0_PTA_WIN_DIS		BIT(15)
+ 
+-#define MT_AGG_PCR1_RTS0_NUM_THRES	GENMASK(31, 23)
+-#define MT_AGG_PCR1_RTS0_LEN_THRES	GENMASK(19, 0)
++#define MT_AGG_PCR1_RTS0_NUM_THRES		GENMASK(31, 23)
++#define MT_AGG_PCR1_RTS0_LEN_THRES		GENMASK(19, 0)
++#define MT_AGG_PCR1_RTS0_NUM_THRES_MT7916	GENMASK(29, 24)
++#define MT_AGG_PCR1_RTS0_LEN_THRES_MT7916	GENMASK(22, 0)
+ 
+ #define MT_AGG_ACR0(_band)		MT_WF_AGG(_band, __OFFS(AGG_ACR0))
+ #define MT_AGG_ACR_CFEND_RATE		GENMASK(13, 0)
+diff --git a/mt7915/testmode.c b/mt7915/testmode.c
+index 0d76ae3..4693919 100644
+--- a/mt7915/testmode.c
++++ b/mt7915/testmode.c
+@@ -30,7 +30,7 @@ struct reg_band {
+ 		{ _list.band[0] = MT_##_reg(0, _idx);	\
+ 		  _list.band[1] = MT_##_reg(1, _idx); }
+ 
+-#define TM_REG_MAX_ID	17
++#define TM_REG_MAX_ID	20
+ static struct reg_band reg_backup_list[TM_REG_MAX_ID];
+ 
+ 
+@@ -133,6 +133,21 @@ mt7915_tm_clean_hwq(struct mt7915_phy *phy, u8 wcid)
+ 				 sizeof(req), false);
+ }
+ 
++static int
++mt7915_tm_set_phy_count(struct mt7915_phy *phy, u8 control)
++{
++	struct mt7915_dev *dev = phy->dev;
++	struct mt7915_tm_cmd req = {
++		.testmode_en = 1,
++		.param_idx = MCU_ATE_SET_PHY_COUNT,
++		.param.cfg.enable = control,
++		.param.cfg.band = phy != &dev->phy,
++	};
++
++	return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(ATE_CTRL), &req,
++				 sizeof(req), false);
++}
++
+ static int
+ mt7915_tm_set_slot_time(struct mt7915_phy *phy, u8 slot_time, u8 sifs)
+ {
+@@ -336,7 +351,7 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
+ {
+ 	int n_regs = ARRAY_SIZE(reg_backup_list);
+ 	struct mt7915_dev *dev = phy->dev;
+-	u32 *b = phy->test.reg_backup;
++	u32 *b = phy->test.reg_backup, val;
+ 	u8 band = phy->mt76->band_idx;
+ 	int i;
+ 
+@@ -349,18 +364,28 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
+ 	REG_BAND(reg_backup_list[6], AGG_MRCR);
+ 	REG_BAND(reg_backup_list[7], TMAC_TFCR0);
+ 	REG_BAND(reg_backup_list[8], TMAC_TCR0);
+-	REG_BAND(reg_backup_list[9], AGG_ATCR1);
+-	REG_BAND(reg_backup_list[10], AGG_ATCR3);
+-	REG_BAND(reg_backup_list[11], TMAC_TRCR0);
+-	REG_BAND(reg_backup_list[12], TMAC_ICR0);
+-	REG_BAND_IDX(reg_backup_list[13], ARB_DRNGR0, 0);
+-	REG_BAND_IDX(reg_backup_list[14], ARB_DRNGR0, 1);
+-	REG_BAND(reg_backup_list[15], WF_RFCR);
+-	REG_BAND(reg_backup_list[16], WF_RFCR1);
++	REG_BAND(reg_backup_list[9], TMAC_TCR2);
++	REG_BAND(reg_backup_list[10], AGG_ATCR1);
++	REG_BAND(reg_backup_list[11], AGG_ATCR3);
++	REG_BAND(reg_backup_list[12], TMAC_TRCR0);
++	REG_BAND(reg_backup_list[13], TMAC_ICR0);
++	REG_BAND_IDX(reg_backup_list[14], ARB_DRNGR0, 0);
++	REG_BAND_IDX(reg_backup_list[15], ARB_DRNGR0, 1);
++	REG_BAND(reg_backup_list[16], WF_RFCR);
++	REG_BAND(reg_backup_list[17], WF_RFCR1);
++
++	if (is_mt7916(&dev->mt76)) {
++		reg_backup_list[18].band[band] = MT_MDP_TOP_DBG_WDT_CTRL;
++		reg_backup_list[19].band[band] = MT_MDP_TOP_DBG_CTRL;
++	}
+ 
+ 	if (phy->mt76->test.state == MT76_TM_STATE_OFF) {
+-		for (i = 0; i < n_regs; i++)
+-			mt76_wr(dev, reg_backup_list[i].band[band], b[i]);
++		for (i = 0; i < n_regs; i++) {
++			u8 reg = reg_backup_list[i].band[band];
++
++			if (reg)
++				mt76_wr(dev, reg, b[i]);
++		}
+ 		return;
+ 	}
+ 
+@@ -380,8 +405,13 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
+ 		   MT_AGG_PCR0_BW40_PROT | MT_AGG_PCR0_BW80_PROT);
+ 	mt76_set(dev, MT_AGG_PCR0(band, 0), MT_AGG_PCR0_PTA_WIN_DIS);
+ 
+-	mt76_wr(dev, MT_AGG_PCR0(band, 1), MT_AGG_PCR1_RTS0_NUM_THRES |
+-		MT_AGG_PCR1_RTS0_LEN_THRES);
++	if (is_mt7915(&dev->mt76))
++		val = MT_AGG_PCR1_RTS0_NUM_THRES | MT_AGG_PCR1_RTS0_LEN_THRES;
++	else
++		val = MT_AGG_PCR1_RTS0_NUM_THRES_MT7916 |
++		      MT_AGG_PCR1_RTS0_LEN_THRES_MT7916;
++
++	mt76_wr(dev, MT_AGG_PCR0(band, 1), val);
+ 
+ 	mt76_clear(dev, MT_AGG_MRCR(band), MT_AGG_MRCR_BAR_CNT_LIMIT |
+ 		   MT_AGG_MRCR_LAST_RTS_CTS_RN | MT_AGG_MRCR_RTS_FAIL_LIMIT |
+@@ -394,10 +424,19 @@ mt7915_tm_reg_backup_restore(struct mt7915_phy *phy)
+ 
+ 	mt76_wr(dev, MT_TMAC_TFCR0(band), 0);
+ 	mt76_clear(dev, MT_TMAC_TCR0(band), MT_TMAC_TCR0_TBTT_STOP_CTRL);
++	mt76_set(dev, MT_TMAC_TCR2(band), MT_TMAC_TCR2_SCH_DET_DIS);
+ 
+ 	/* config rx filter for testmode rx */
+ 	mt76_wr(dev, MT_WF_RFCR(band), 0xcf70a);
+ 	mt76_wr(dev, MT_WF_RFCR1(band), 0);
++
++	if (is_mt7916(&dev->mt76)) {
++		/* enable MDP Tx block mode */
++		mt76_clear(dev, MT_MDP_TOP_DBG_WDT_CTRL,
++			   MT_MDP_TOP_DBG_WDT_CTRL_TDP_DIS_BLK);
++		mt76_clear(dev, MT_MDP_TOP_DBG_CTRL,
++			   MT_MDP_TOP_DBG_CTRL_ENQ_MODE);
++	}
+ }
+ 
+ static void
+@@ -417,6 +456,8 @@ mt7915_tm_init(struct mt7915_phy *phy, bool en)
+ 	mt7915_mcu_add_bss_info(phy, phy->monitor_vif, en);
+ 	mt7915_mcu_add_sta(dev, phy->monitor_vif, NULL, en);
+ 
++	phy->mt76->test.flag |= MT_TM_FW_RX_COUNT;
++
+ 	if (!en)
+ 		mt7915_tm_set_tam_arb(phy, en, 0);
+ }
+@@ -479,18 +520,63 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en)
+ 	mt7915_tm_set_trx(phy, TM_MAC_TX, en);
+ }
+ 
++static int
++mt7915_tm_get_rx_stats(struct mt7915_phy *phy, bool clear)
++{
++#define CMD_RX_STAT_BAND	0x3
++	struct mt76_testmode_data *td = &phy->mt76->test;
++	struct mt7915_tm_rx_stat_band *rs_band;
++	struct mt7915_dev *dev = phy->dev;
++	struct sk_buff *skb;
++	struct {
++		u8 format_id;
++		u8 band;
++		u8 _rsv[2];
++	} __packed req = {
++		.format_id = CMD_RX_STAT_BAND,
++		.band = phy->mt76->band_idx,
++	};
++	int ret;
++
++	ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_CMD(RX_STAT),
++					&req, sizeof(req), true, &skb);
++	if (ret)
++		return ret;
++
++	rs_band = (struct mt7915_tm_rx_stat_band *)skb->data;
++	/* pr_info("mdrdy_cnt = %d\n", le32_to_cpu(rs_band->mdrdy_cnt)); */
++	/* pr_info("fcs_err = %d\n", le16_to_cpu(rs_band->fcs_err)); */
++	/* pr_info("len_mismatch = %d\n", le16_to_cpu(rs_band->len_mismatch)); */
++	/* pr_info("fcs_ok = %d\n", le16_to_cpu(rs_band->fcs_succ)); */
++
++	if (!clear) {
++		enum mt76_rxq_id q = req.band ? MT_RXQ_BAND1 : MT_RXQ_MAIN;
++
++		td->rx_stats.packets[q] += le32_to_cpu(rs_band->mdrdy_cnt);
++		td->rx_stats.fcs_error[q] += le16_to_cpu(rs_band->fcs_err);
++		td->rx_stats.len_mismatch += le16_to_cpu(rs_band->len_mismatch);
++	}
++
++	dev_kfree_skb(skb);
++
++	return 0;
++}
++
+ static void
+ mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en)
+ {
+ 	mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false);
+ 
+ 	if (en) {
+-		struct mt7915_dev *dev = phy->dev;
+-
+ 		mt7915_tm_update_channel(phy);
+ 
+ 		/* read-clear */
+-		mt76_rr(dev, MT_MIB_SDR3(phy->mt76->band_idx));
++		mt7915_tm_get_rx_stats(phy, true);
++
++		/* clear fw count */
++		mt7915_tm_set_phy_count(phy, 0);
++		mt7915_tm_set_phy_count(phy, 1);
++
+ 		mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en);
+ 	}
+ }
+@@ -721,12 +807,8 @@ static int
+ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+ {
+ 	struct mt7915_phy *phy = mphy->priv;
+-	struct mt7915_dev *dev = phy->dev;
+-	enum mt76_rxq_id q;
+ 	void *rx, *rssi;
+-	u16 fcs_err;
+ 	int i;
+-	u32 cnt;
+ 
+ 	rx = nla_nest_start(msg, MT76_TM_STATS_ATTR_LAST_RX);
+ 	if (!rx)
+@@ -770,15 +852,7 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg)
+ 
+ 	nla_nest_end(msg, rx);
+ 
+-	cnt = mt76_rr(dev, MT_MIB_SDR3(phy->mt76->band_idx));
+-	fcs_err = is_mt7915(&dev->mt76) ? FIELD_GET(MT_MIB_SDR3_FCS_ERR_MASK, cnt) :
+-		FIELD_GET(MT_MIB_SDR3_FCS_ERR_MASK_MT7916, cnt);
+-
+-	q = phy->mt76->band_idx ? MT_RXQ_BAND1 : MT_RXQ_MAIN;
+-	mphy->test.rx_stats.packets[q] += fcs_err;
+-	mphy->test.rx_stats.fcs_error[q] += fcs_err;
+-
+-	return 0;
++	return mt7915_tm_get_rx_stats(phy, false);
+ }
+ 
+ const struct mt76_testmode_ops mt7915_testmode_ops = {
+diff --git a/mt7915/testmode.h b/mt7915/testmode.h
+index 5573ac3..a1c54c8 100644
+--- a/mt7915/testmode.h
++++ b/mt7915/testmode.h
+@@ -33,6 +33,12 @@ struct mt7915_tm_clean_txq {
+ 	u8 rsv;
+ };
+ 
++struct mt7915_tm_cfg {
++	u8 enable;
++	u8 band;
++	u8 _rsv[2];
++};
++
+ struct mt7915_tm_cmd {
+ 	u8 testmode_en;
+ 	u8 param_idx;
+@@ -43,6 +49,7 @@ struct mt7915_tm_cmd {
+ 		struct mt7915_tm_freq_offset freq;
+ 		struct mt7915_tm_slot_time slot;
+ 		struct mt7915_tm_clean_txq clean;
++		struct mt7915_tm_cfg cfg;
+ 		u8 test[72];
+ 	} param;
+ } __packed;
+@@ -102,4 +109,25 @@ enum {
+ 	TAM_ARB_OP_MODE_FORCE_SU = 5,
+ };
+ 
++struct mt7915_tm_rx_stat_band {
++	u8 category;
++
++	/* mac */
++	__le16 fcs_err;
++	__le16 len_mismatch;
++	__le16 fcs_succ;
++	__le32 mdrdy_cnt;
++	/* phy */
++	__le16 fcs_err_cck;
++	__le16 fcs_err_ofdm;
++	__le16 pd_cck;
++	__le16 pd_ofdm;
++	__le16 sig_err_cck;
++	__le16 sfd_err_cck;
++	__le16 sig_err_ofdm;
++	__le16 tag_err_ofdm;
++	__le16 mdrdy_cnt_cck;
++	__le16 mdrdy_cnt_ofdm;
++};
++
+ #endif
+diff --git a/testmode.c b/testmode.c
+index 0accc71..1d0d5d3 100644
+--- a/testmode.c
++++ b/testmode.c
+@@ -447,8 +447,7 @@ int mt76_testmode_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_LDPC], &td->tx_rate_ldpc, 0, 1) ||
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_RATE_STBC], &td->tx_rate_stbc, 0, 1) ||
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_LTF], &td->tx_ltf, 0, 2) ||
+-	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_ANTENNA],
+-			   &td->tx_antenna_mask, 0, 0xff) ||
++	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_ANTENNA], &td->tx_antenna_mask, 1, 0xff) ||
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_SPE_IDX], &td->tx_spe_idx, 0, 27) ||
+ 	    mt76_tm_get_u8(tb[MT76_TM_ATTR_TX_DUTY_CYCLE],
+ 			   &td->tx_duty_cycle, 0, 99) ||
+@@ -560,6 +559,9 @@ mt76_testmode_dump_stats(struct mt76_phy *phy, struct sk_buff *msg)
+ 	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_PACKETS, rx_packets,
+ 			      MT76_TM_STATS_ATTR_PAD) ||
+ 	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_FCS_ERROR, rx_fcs_error,
++			      MT76_TM_STATS_ATTR_PAD) ||
++	    nla_put_u64_64bit(msg, MT76_TM_STATS_ATTR_RX_LEN_MISMATCH,
++			      td->rx_stats.len_mismatch,
+ 			      MT76_TM_STATS_ATTR_PAD))
+ 		return -EMSGSIZE;
+ 
+diff --git a/testmode.h b/testmode.h
+index 5e2792d..8961326 100644
+--- a/testmode.h
++++ b/testmode.h
+@@ -101,6 +101,8 @@ enum mt76_testmode_attr {
+  * @MT76_TM_STATS_ATTR_RX_FCS_ERROR: number of rx packets with FCS error (u64)
+  * @MT76_TM_STATS_ATTR_LAST_RX: information about the last received packet
+  *	see &enum mt76_testmode_rx_attr
++ * @MT76_TM_STATS_ATTR_RX_LEN_MISMATCH: number of rx packets with length
++ *	mismatch error (u64)
+  */
+ enum mt76_testmode_stats_attr {
+ 	MT76_TM_STATS_ATTR_UNSPEC,
+@@ -113,6 +115,7 @@ enum mt76_testmode_stats_attr {
+ 	MT76_TM_STATS_ATTR_RX_PACKETS,
+ 	MT76_TM_STATS_ATTR_RX_FCS_ERROR,
+ 	MT76_TM_STATS_ATTR_LAST_RX,
++	MT76_TM_STATS_ATTR_RX_LEN_MISMATCH,
+ 
+ 	/* keep last */
+ 	NUM_MT76_TM_STATS_ATTRS,
+-- 
+2.18.0
+