On this mac80211/mt7921u stack, Android's WifiCountryCode path issues
the private DRIVER COUNTRY command (a Broadcom-era AIDL path), which
is a silent no-op. The kernel never receives NL80211_CMD_REQ_SET_REG,
so scanning runs in world regdom (00) with 5GHz passive-only.
Ship country=US in wpa_supplicant_overlay.conf, loaded by the supplicant
AIDL service (addStaInterfaceInternal -> confanother) at every interface
init. This goes through wpa_drv_set_country() -> nl80211's set_country,
issuing a genuine user regulatory hint to the kernel.
Brendan Szymanski
b038e85305