diff --git a/autobuild_mac80211_release/package/network/services/hostapd/patches/mtk-0030-hostapd-mtk-Add-muru-user-number-debug-command.patch b/autobuild_mac80211_release/package/network/services/hostapd/patches/mtk-0030-hostapd-mtk-Add-muru-user-number-debug-command.patch
new file mode 100644
index 0000000..c405a4d
--- /dev/null
+++ b/autobuild_mac80211_release/package/network/services/hostapd/patches/mtk-0030-hostapd-mtk-Add-muru-user-number-debug-command.patch
@@ -0,0 +1,220 @@
+From 985f076026a2e4d7083272da975601be9b74d806 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+Date: Thu, 27 Apr 2023 15:28:43 +0800
+Subject: [PATCH] hostapd: mtk: Add muru user number debug command
+
+---
+ hostapd/ctrl_iface.c         | 11 ++++++++++-
+ src/ap/ap_drv_ops.c          |  4 ++--
+ src/ap/ap_drv_ops.h          |  2 +-
+ src/ap/hostapd.c             |  4 ++--
+ src/common/mtk_vendor.h      |  7 +++++++
+ src/drivers/driver.h         |  4 ++--
+ src/drivers/driver_nl80211.c | 37 ++++++++++++++++++++++++++++--------
+ 7 files changed, 53 insertions(+), 16 deletions(-)
+
+diff --git a/hostapd/ctrl_iface.c b/hostapd/ctrl_iface.c
+index becb09c..3391015 100644
+--- a/hostapd/ctrl_iface.c
++++ b/hostapd/ctrl_iface.c
+@@ -3473,6 +3473,8 @@ hostapd_ctrl_iface_set_mu(struct hostapd_data *hapd, char *cmd,
+ 					 char *buf, size_t buflen)
+ {
+ 	char *pos, *config, *value;
++	u8 mode;
++
+ 	config = cmd;
+ 	pos = os_strchr(config, ' ');
+ 	if (pos == NULL)
+@@ -3490,13 +3492,20 @@ hostapd_ctrl_iface_set_mu(struct hostapd_data *hapd, char *cmd,
+ 			return -1;
+ 		}
+ 		hapd->iconf->mu_onoff = (u8) mu;
++		mode = MU_CTRL_ONOFF;
++	} else if (os_strcmp(config, "ul_user_cnt") == 0) {
++		mode = MU_CTRL_UL_USER_CNT;
++		wpa_printf(MSG_ERROR, "ul_user_cnt:%d\n", (u8)atoi(value));
++	} else if (os_strcmp(config, "dl_user_cnt") == 0) {
++		mode = MU_CTRL_DL_USER_CNT;
++		wpa_printf(MSG_ERROR, "dl_user_cnt:%d\n", (u8)atoi(value));
+ 	} else {
+ 		wpa_printf(MSG_ERROR,
+ 			"Unsupported parameter %s for SET_MU", config);
+ 		return -1;
+ 	}
+ 
+-	if(hostapd_drv_mu_ctrl(hapd) == 0) {
++	if(hostapd_drv_mu_ctrl(hapd, mode, (u8)atoi(value)) == 0) {
+ 		return os_snprintf(buf, buflen, "OK\n");
+ 	} else {
+ 		return -1;
+diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
+index eafa588..bf64b77 100644
+--- a/src/ap/ap_drv_ops.c
++++ b/src/ap/ap_drv_ops.c
+@@ -1040,11 +1040,11 @@ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value)
+ 	return hapd->driver->get_edcca(hapd->drv_priv, mode, value);
+ }
+ 
+-int hostapd_drv_mu_ctrl(struct hostapd_data *hapd)
++int hostapd_drv_mu_ctrl(struct hostapd_data *hapd, u8 mode, u8 val)
+ {
+ 	if (!hapd->driver || !hapd->driver->mu_ctrl)
+ 		return 0;
+-	return hapd->driver->mu_ctrl(hapd->drv_priv, hapd->iconf->mu_onoff);
++	return hapd->driver->mu_ctrl(hapd->drv_priv, mode, val);
+ }
+ 
+ int hostapd_drv_mu_dump(struct hostapd_data *hapd, u8 *mu_onoff)
+diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
+index 28f2a4d..2a89b99 100644
+--- a/src/ap/ap_drv_ops.h
++++ b/src/ap/ap_drv_ops.h
+@@ -142,7 +142,7 @@ int hostapd_drv_configure_edcca_enable(struct hostapd_data *hapd);
+ int hostapd_drv_configure_edcca_threshold(struct hostapd_data *hapd,
+ 					  const int *threshold);
+ int hostapd_drv_get_edcca(struct hostapd_data *hapd, const u8 mode, u8 *value);
+-int hostapd_drv_mu_ctrl(struct hostapd_data *hapd);
++int hostapd_drv_mu_ctrl(struct hostapd_data *hapd, u8 mode, u8 val);
+ int hostapd_drv_mu_dump(struct hostapd_data *hapd, u8 *mu_onoff);
+ int hostapd_drv_three_wire_ctrl(struct hostapd_data *hapd);
+ int hostapd_drv_ibf_ctrl(struct hostapd_data *hapd);
+diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
+index b2fd9b9..49a1d30 100644
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -55,7 +55,7 @@
+ #include "hs20.h"
+ #include "airtime_policy.h"
+ #include "wpa_auth_kay.h"
+-
++#include "common/mtk_vendor.h"
+ 
+ static int hostapd_flush_old_stations(struct hostapd_data *hapd, u16 reason);
+ #ifdef CONFIG_WEP
+@@ -2360,7 +2360,7 @@ dfs_offload:
+ 	if (hostapd_drv_configure_edcca_threshold(hapd,
+ 						  hapd->iconf->edcca_threshold) < 0)
+ 		goto fail;
+-	if (hostapd_drv_mu_ctrl(hapd) < 0)
++	if (hostapd_drv_mu_ctrl(hapd, MU_CTRL_ONOFF, hapd->iconf->mu_onoff) < 0)
+ 		goto fail;
+ 	if (hostapd_drv_three_wire_ctrl(hapd) < 0)
+ 		goto fail;
+diff --git a/src/common/mtk_vendor.h b/src/common/mtk_vendor.h
+index 74f467c..7dd2fc4 100644
+--- a/src/common/mtk_vendor.h
++++ b/src/common/mtk_vendor.h
+@@ -197,6 +197,8 @@ enum mtk_vendor_attr_mu_ctrl {
+ 
+ 	MTK_VENDOR_ATTR_MU_CTRL_ONOFF,
+ 	MTK_VENDOR_ATTR_MU_CTRL_DUMP,
++	MTK_VENDOR_ATTR_MU_CTRL_OFDMA_MODE,
++	MTK_VENDOR_ATTR_MU_CTRL_OFDMA_VAL,
+ 
+ 	/* keep last */
+ 	NUM_MTK_VENDOR_ATTRS_MU_CTRL,
+@@ -270,4 +272,9 @@ struct amnt_resp_data {
+ 	struct amnt_data resp_data[0];
+ };
+ 
++enum {
++	MU_CTRL_ONOFF,
++	MU_CTRL_DL_USER_CNT,
++	MU_CTRL_UL_USER_CNT,
++};
+ #endif /* MTK_VENDOR_H */
+diff --git a/src/drivers/driver.h b/src/drivers/driver.h
+index 1444cbe..01281a1 100644
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -4742,11 +4742,11 @@ struct wpa_driver_ops {
+ 	int (*get_edcca)(void *priv, const u8 mode, u8 *value);
+ 
+ 	/**
+-	 * mu_ctrl - ctrl on off for UL/DL MURU
++	 * mu_ctrl - ctrl for UL/DL MURU
+ 	 * @priv: Private driver interface data
+ 	 *
+ 	 */
+-	 int (*mu_ctrl)(void *priv, u8 mu_onoff);
++	 int (*mu_ctrl)(void *priv, u8 mode, u8 val);
+ 	 int (*mu_dump)(void *priv, u8 *mu_onoff);
+ 
+ 	/**
+diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
+index 0470079..3d71405 100644
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -12430,13 +12430,13 @@ fail:
+ 
+ 
+ #ifdef CONFIG_IEEE80211AX
+-static int nl80211_mu_onoff(void *priv, u8 mu_onoff)
++static int nl80211_mu_ctrl(void *priv, u8 mode, u8 val)
+ {
+ 	struct i802_bss *bss = priv;
+ 	struct wpa_driver_nl80211_data *drv = bss->drv;
+ 	struct nl_msg *msg;
+ 	struct nlattr *data;
+-	int ret;
++	int ret = -ENOBUFS;
+ 
+ 	if (!drv->mtk_mu_vendor_cmd_avail) {
+ 		wpa_printf(MSG_INFO,
+@@ -12447,17 +12447,38 @@ static int nl80211_mu_onoff(void *priv, u8 mu_onoff)
+ 	if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
+ 		nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_MTK) ||
+ 		nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, MTK_NL80211_VENDOR_SUBCMD_MU_CTRL) ||
+-		!(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
+-		nla_put_u8(msg, MTK_VENDOR_ATTR_MU_CTRL_ONOFF, mu_onoff)) {
+-		nlmsg_free(msg);
+-		return -ENOBUFS;
++		!(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)))
++		goto fail;
++
++	switch (mode) {
++	case MU_CTRL_ONOFF:
++			if (nla_put_u8(msg, MTK_VENDOR_ATTR_MU_CTRL_ONOFF, val))
++				goto fail;
++		break;
++	case MU_CTRL_UL_USER_CNT:
++	case MU_CTRL_DL_USER_CNT:
++			if (nla_put_u8(msg, MTK_VENDOR_ATTR_MU_CTRL_OFDMA_MODE, mode) ||
++			    nla_put_u8(msg, MTK_VENDOR_ATTR_MU_CTRL_OFDMA_VAL, val))
++				goto fail;
++		break;
++	default:
++		wpa_printf(MSG_ERROR, "nl80211: Wrong mu mode !");
++		ret = -EINVAL;
++		goto fail;
+ 	}
++
+ 	nla_nest_end(msg, data);
++
+ 	ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
+ 	if(ret){
+-		wpa_printf(MSG_ERROR, "Failed to set mu_onoff. ret=%d (%s)", ret, strerror(-ret));
++		wpa_printf(MSG_ERROR, "Failed to set mu_ctrl. ret=%d (%s)", ret, strerror(-ret));
+ 	}
+ 	return ret;
++
++fail:
++	nl80211_nlmsg_clear(msg);
++	nlmsg_free(msg);
++	return ret;
+ }
+ 
+ 
+@@ -13512,7 +13533,7 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
+ 	.update_connect_params = nl80211_update_connection_params,
+ 	.send_external_auth_status = nl80211_send_external_auth_status,
+ 	.set_4addr_mode = nl80211_set_4addr_mode,
+-	.mu_ctrl = nl80211_mu_onoff,
++	.mu_ctrl = nl80211_mu_ctrl,
+ 	.mu_dump = nl80211_mu_dump,
+ #ifdef CONFIG_DPP
+ 	.dpp_listen = nl80211_dpp_listen,
+-- 
+2.39.0
+