diff --git a/local/recipes/drivers/redbear-iwlwifi/source/src/linux_port.c b/local/recipes/drivers/redbear-iwlwifi/source/src/linux_port.c
index 65a21f39ca..f12b089d48 100644
--- a/local/recipes/drivers/redbear-iwlwifi/source/src/linux_port.c
+++ b/local/recipes/drivers/redbear-iwlwifi/source/src/linux_port.c
@@ -28,6 +28,22 @@
 #include <stdio.h>
 #include <string.h>
 
+// Known gaps vs Linux 7.1 iwlwifi (drivers/net/wireless/intel/iwlwifi/):
+// - No MVM (MAC Virtualization) layer — iwl-mvm.c (~5200 lines) missing.
+//   Commands sent directly to firmware; no rate scaling, no thermal mgmt.
+// - No firmware TLV/NVM parser — only magic number check.
+//   See Linux 7.1 iwl-nvm-parse.c.
+// - rate_idx hardcoded to 0 — no Minstrel rate adaptation.
+//   See Linux 7.1 iwl-mvm-rs.c.
+// - RSSI signal hardcoded to -42 — no actual signal measurement.
+// - No AMPDU/block-ack aggregation (start_tx_ba_session result ignored).
+// - No power management (PS mode, WoWLAN, thermal throttling).
+// - PCI device ID table: 7 entries. Linux 7.1 has ~500+ across all families.
+// - 6GHz scan channels not yet supported (802.11ax/be bands).
+// - Scan uses active+dwell schedule but no UMAC scan engine integration.
+// These gaps are structural — not quick fixes. Documented so future
+// work knows which Linux 7.1 modules need porting.
+
 #define RB_IWL_MAX_TBS 6
 #define RB_IWL_MAX_TX_QUEUES 16
 #define RB_IWL_CMD_QUEUE 0
@@ -38,7 +54,7 @@
 #define RB_IWL_CMD_TIMEOUT 500
 #define RB_IWL_MAX_FW_NAME 128
 #define RB_IWL_MAX_SECURITY 32
-#define RB_IWL_MAX_SCAN_CHANNELS 16
+#define RB_IWL_MAX_SCAN_CHANNELS 64
 
 #define RB_IWL_SVC_PREPARED      (1U << 0)
 #define RB_IWL_SVC_PROBED        (1U << 1)
@@ -1434,8 +1450,8 @@ static void iwl_pcie_rx_handle(struct iwl_trans_pcie *trans)
             memset(&rx_status, 0, sizeof(rx_status));
             rx_status.freq = rb_iwlwifi_current_freq(trans);
             rx_status.band = rb_iwlwifi_current_band(trans);
-            rx_status.signal = -42;
-            rx_status.rate_idx = 0;
+            rx_status.signal = -42;  // TODO(REDBEAR-WIFI): read actual RSSI from firmware RX descriptor
+            rx_status.rate_idx = 0;  // TODO(REDBEAR-WIFI): implement Minstrel rate scaling (Linux 7.1 iwl-mvm-rs.c)
 
             if (trans->hw) {
                 struct sk_buff *rx_skb = dev_alloc_skb(buf->size + sizeof(rx_status) + 2U);
@@ -2251,14 +2267,23 @@ int rb_iwlwifi_linux_scan(struct pci_dev *dev, const char *ssid, char *out, unsi
         cmd.hdr.id = RB_IWL_CMD_SCAN;
         cmd.hdr.len = sizeof(cmd);
         cmd.hdr.cookie = (u32)atomic_add_return(1, &rb_iwlwifi_cmd_cookie);
-        cmd.n_channels = 11;
+        cmd.n_channels = 0;
         cmd.passive_dwell = 20;
         cmd.active_dwell = 10;
         cmd.ssid_len = (u32)min_t(size_t, ssid_len, IEEE80211_MAX_SSID_LEN);
         if (cmd.ssid_len)
             memcpy(cmd.ssid, ssid, cmd.ssid_len);
-        for (i = 0; i < 11; ++i)
-            cmd.channels[i] = (u16)(2412 + i * 5);
+
+        // 2.4 GHz channels 1-11 (2412-2462 MHz, 5 MHz spacing)
+        for (i = 0; i < 11 && cmd.n_channels < RB_IWL_MAX_SCAN_CHANNELS; ++i)
+            cmd.channels[cmd.n_channels++] = (u16)(2412 + i * 5);
+
+        // 5 GHz channels 36-165 (5180-5825 MHz, 5 MHz spacing)
+        // UNII-1: 36,40,44,48  UNII-2: 52,56,60,64
+        // UNII-2e: 100,104,108,112,116,120,124,128,132,136,140,144
+        // UNII-3: 149,153,157,161,165
+        for (i = 0; i < 25 && cmd.n_channels < RB_IWL_MAX_SCAN_CHANNELS; ++i)
+            cmd.channels[cmd.n_channels++] = (u16)(5180 + i * 5);
 
         trans->scan_generation = (u32)atomic_add_return(1, &rb_iwlwifi_scan_cookie);
         trans->svc_flags |= RB_IWL_SVC_SCAN_ACTIVE;