diff --git a/feeds/wifi-ax/mac80211/patches/qca/225-ath11k-add_cmd_processing_time_for_scan_timeout.patch b/feeds/wifi-ax/mac80211/patches/qca/225-ath11k-add_cmd_processing_time_for_scan_timeout.patch
new file mode 100644
index 000000000..f5ebfac75
--- /dev/null
+++ b/feeds/wifi-ax/mac80211/patches/qca/225-ath11k-add_cmd_processing_time_for_scan_timeout.patch
@@ -0,0 +1,22 @@
+diff -Naur a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
+--- a/drivers/net/wireless/ath/ath11k/mac.c	2021-06-09 10:02:12.040840722 -0400
++++ b/drivers/net/wireless/ath/ath11k/mac.c	2021-06-10 10:40:12.094003411 -0400
+@@ -3472,13 +3472,14 @@
+ 		scan_timeout = min_t(u32, arg->max_rest_time *
+ 				    (arg->chan_list.num_chan - 1) + (req->duration +
+ 				     ATH11K_SCAN_CHANNEL_SWITCH_WMI_EVT_OVERHEAD) *
+-				     arg->chan_list.num_chan, arg->max_scan_time +
+-				     ATH11K_MAC_SCAN_TIMEOUT_MSECS);
++				     arg->chan_list.num_chan, arg->max_scan_time);
+ 	} else {
+-		/* Add a 200ms margin to account for event/command processing */
+-		scan_timeout = arg->max_scan_time + ATH11K_MAC_SCAN_TIMEOUT_MSECS;
++		scan_timeout = arg->max_scan_time;
+ 	}
+ 
++	/* Add a 200ms margin to account for event/command processing */
++	scan_timeout += ATH11K_MAC_SCAN_TIMEOUT_MSECS;
++
+ 	ret = ath11k_start_scan(ar, arg);
+ 	if (ret) {
+ 		ath11k_warn(ar->ab, "failed to start hw scan: %d\n", ret);
diff --git a/feeds/wifi-trunk/ath10k-ct/patches/960-0012-ath10k-add_cmd_processing_time_for_scan_timeout.patch b/feeds/wifi-trunk/ath10k-ct/patches/960-0012-ath10k-add_cmd_processing_time_for_scan_timeout.patch
new file mode 100644
index 000000000..9a2118167
--- /dev/null
+++ b/feeds/wifi-trunk/ath10k-ct/patches/960-0012-ath10k-add_cmd_processing_time_for_scan_timeout.patch
@@ -0,0 +1,22 @@
+diff -Naur a/ath10k-5.7/mac.c b/ath10k-5.7/mac.c
+--- a/ath10k-5.7/mac.c	2021-06-09 16:30:17.793556032 -0400
++++ b/ath10k-5.7/mac.c	2021-06-09 17:38:08.587733979 -0400
+@@ -7103,13 +7103,15 @@
+ 		scan_timeout = min_t(u32, arg.max_rest_time *
+ 				(arg.n_channels - 1) + (req->duration +
+ 				ATH10K_SCAN_CHANNEL_SWITCH_WMI_EVT_OVERHEAD) *
+-				arg.n_channels, arg.max_scan_time + 200);
++				arg.n_channels, arg.max_scan_time);
+ 
+ 	} else {
+-		/* Add a 200ms margin to account for event/command processing */
+-		scan_timeout = arg.max_scan_time + 200;
++		scan_timeout = arg.max_scan_time;
+ 	}
+ 
++	/* Add a 200ms margin to account for event/command processing */
++	scan_timeout += 200;
++
+ 	ret = ath10k_start_scan(ar, &arg);
+ 	if (ret) {
+ 		ath10k_warn(ar, "failed to start hw scan: %d\n", ret);
diff --git a/feeds/wlan-ap/opensync/patches/38-correcting-scan-type-max-count.patch b/feeds/wlan-ap/opensync/patches/38-correcting-scan-type-max-count.patch
new file mode 100644
index 000000000..c2bd6d79b
--- /dev/null
+++ b/feeds/wlan-ap/opensync/patches/38-correcting-scan-type-max-count.patch
@@ -0,0 +1,16 @@
+Index: opensync-2.0.5.0/src/lib/datapipeline/inc/dpp_types.h
+===================================================================
+--- opensync-2.0.5.0.orig/src/lib/datapipeline/inc/dpp_types.h
++++ opensync-2.0.5.0/src/lib/datapipeline/inc/dpp_types.h
+@@ -148,10 +148,9 @@ typedef enum
+     RADIO_SCAN_TYPE_FULL,
+     RADIO_SCAN_TYPE_ONCHAN,
+     RADIO_SCAN_TYPE_OFFCHAN,
++    RADIO_SCAN_MAX_TYPE_QTY
+ } radio_scan_type_t;
+ 
+-#define RADIO_SCAN_MAX_TYPE_QTY       3
+-
+ typedef enum
+ {
+     RADIO_QUEUE_TYPE_VI = 0,
diff --git a/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/src/stats_nl80211.c b/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/src/stats_nl80211.c
index 53cd8635d..e67d57987 100644
--- a/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/src/stats_nl80211.c
+++ b/feeds/wlan-ap/opensync/src/platform/openwrt/src/lib/target/src/stats_nl80211.c
@@ -550,20 +550,39 @@ int nl80211_scan_trigger(struct nl_call_param *nl_call_param, uint32_t *chan_lis
 	struct nlattr *freq;
 	unsigned int i, flags = 0;
 	int ret = 0;
+	uint32_t oper_chan;
 
 	if (!msg)
 		return -1;
 
-	LOGT("%s: not setting dwell time\n", nl_call_param->ifname);
-	//nla_put_u16(msg, NL80211_ATTR_MEASUREMENT_DURATION, dwell_time);
+	if (nl80211_get_oper_channel(nl_call_param->ifname, &oper_chan) < 0) {
+		/* Could not get the current operating channel */
+		oper_chan = 0;
+		LOGE("%s: Could not get the current operating channel\n",
+			nl_call_param->ifname);
+	}
 
 	/* Add the ap-force flag, otherwise the scan fails on wifi6 APs */
 	flags |= NL80211_SCAN_FLAG_AP;
 	nla_put(msg, NL80211_ATTR_SCAN_FLAGS, sizeof(uint32_t), &flags);
 
+	if ((scan_type == RADIO_SCAN_TYPE_OFFCHAN) && dwell_time)
+		nla_put_u16(msg, NL80211_ATTR_MEASUREMENT_DURATION, dwell_time);
+
 	freq = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
-	for (i = 0; i < chan_num; i ++)
-		nla_put_u32(msg, i, ieee80211_channel_to_frequency(chan_list[i]));
+	for (i = 0; i < chan_num; i ++) {
+		if (!oper_chan || (scan_type == RADIO_SCAN_TYPE_FULL)) {
+			nla_put_u32(msg, i, ieee80211_channel_to_frequency(chan_list[i]));
+		}
+		else if ((scan_type == RADIO_SCAN_TYPE_OFFCHAN) &&
+			(chan_list[i] != oper_chan)) {
+			nla_put_u32(msg, i, ieee80211_channel_to_frequency(chan_list[i]));
+		}
+		else if ((scan_type == RADIO_SCAN_TYPE_ONCHAN) &&
+			(chan_list[i] == oper_chan)) {
+			nla_put_u32(msg, i, ieee80211_channel_to_frequency(chan_list[i]));
+		}
+	}
 	nla_nest_end(msg, freq);
 
 	ret = nl80211_scan_add(nl_call_param->ifname, scan_cb, scan_ctx); 
@@ -573,7 +592,9 @@ int nl80211_scan_trigger(struct nl_call_param *nl_call_param, uint32_t *chan_lis
 	}
 
 	ret = unl_genl_request(&unl_req, msg, nl80211_scan_trigger_recv, NULL);
-	if (ret)	LOG(DEBUG, "%s: scan request failed %d\n", nl_call_param->ifname, ret);
+	if (ret)
+		LOG(DEBUG, "%s: scan request failed %d\n", nl_call_param->ifname, ret);
+
 	return ret;
 }