On this mac80211/mt7921u stack, Android's WifiCountryCode path issues
the private DRIVER COUNTRY command (a Broadcom-era AIDL path), which
is a silent no-op. The kernel never receives NL80211_CMD_REQ_SET_REG,
so scanning runs in world regdom (00) with 5GHz passive-only.
Ship country=US in wpa_supplicant_overlay.conf, loaded by the supplicant
AIDL service (addStaInterfaceInternal -> confanother) at every interface
init. This goes through wpa_drv_set_country() -> nl80211's set_country,
issuing a genuine user regulatory hint to the kernel.
The glob pattern '$drvdir/*/' appended a trailing '/' to each
entry, which caused the shell to dereference symlinks before
the '[ -L ]' test could run. Since the only symlinks in a USB
driver directory ARE the bound device entries (e.g. 4-1:1.0),
'[ -L path/ ]' always returned false and the unbind+rebind
never fired for any driver.
Drop the trailing '/', iterate over all entries, and filter
with '[ -L ]' on the raw name. The module/uevent/new_id
name-skips still work correctly.
The old script only re-probed driverless USB interfaces. Some built-in
USB WiFi drivers (notably mt7921u) do NOT fail probe() when firmware is
missing — they bind 'successfully', then loop on the MCU handshake until
a timeout kills hardware init. The driverless-only reprobe never
touches them, so the adapter stays dead after the initial probe.
Fix: add phase 2 that force-unbinds and re-probes every USB interface
already bound to a known built-in WiFi driver, so their firmware request
runs again now that /vendor/firmware is available on the kernel's
fw_path[].
Also increase the driver list to match all built-in =y USB WiFi drivers
from tart_defconfig.
