--- /dev/null
+From d90618809e06e123241f57efdb7039a7a8a43d58 Mon Sep 17 00:00:00 2001
+From: Alex Gavin <a_gavin@icloud.com>
+Date: Sun, 15 Mar 2026 22:16:46 -0700
+Subject: iw: scan: print RSN Element Override IEs
+
+Parse body of RSN Element Override IEs as RSN IEs
+using existing code.
+
+RSN IEs are a minimum size of 4 octets, as detailed
+in IEEE802.11-2024, 9.4.2.23.1
+
+Example output:
+RSN Element Override:
+ * Version: 1
+ * Group cipher: CCMP
+ * Pairwise ciphers: CCMP
+ * Authentication suites: SAE
+ * Capabilities: 16-PTKSA-RC 1-GTKSA-RC MFP-required MFP-capable (0x00cc)
+RSN Element Override 2:
+ * Version: 1
+ * Group cipher: CCMP
+ * Pairwise ciphers: GCMP-256
+ * Authentication suites: SAE-EXT-KEY
+ * Capabilities: 16-PTKSA-RC 1-GTKSA-RC MFP-required MFP-capable (0x00cc)
+
+Signed-off-by: Alex Gavin <a_gavin@icloud.com>
+Link: https://patch.msgid.link/20260316051646.18303-2-a_gavin@icloud.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ scan.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/scan.c
++++ b/scan.c
+@@ -1893,6 +1893,14 @@ static void print_wifi_osen(const uint8_
+ print_osen_ie("OSEN", "OSEN", len, data);
+ }
+
++static void print_wifi_rsn_override(const uint8_t type, uint8_t len,
++ const uint8_t *data,
++ const struct ie_context *ctx)
++{
++ printf("\n\t");
++ print_rsn_ie("CCMP", "IEEE802.1X", len, data);
++}
++
+ static bool print_wifi_wmm_param(const uint8_t *data, uint8_t len)
+ {
+ int i;
+@@ -2344,6 +2352,8 @@ static const struct ie_print wfa_printer
+ [16] = { "HotSpot 2.0 Indication", print_hs20_ind, 1, 255, BIT(PRINT_SCAN), },
+ [18] = { "HotSpot 2.0 OSEN", print_wifi_osen, 1, 255, BIT(PRINT_SCAN), },
+ [28] = { "OWE Transition Mode", print_wifi_owe_tarns, 7, 255, BIT(PRINT_SCAN), },
++ [41] = { "RSN Element Override", print_wifi_rsn_override, 4, 255, BIT(PRINT_SCAN), },
++ [42] = { "RSN Element Override 2", print_wifi_rsn_override, 4, 255, BIT(PRINT_SCAN), },
+ };
+
+ static void print_vendor(unsigned char len, unsigned char *data,
};
static void print_wifi_wpa(const uint8_t type, uint8_t len, const uint8_t *data,
-@@ -2213,8 +2218,10 @@ static void print_wifi_wps(const uint8_t
+@@ -2221,8 +2226,10 @@ static void print_wifi_wps(const uint8_t
static const struct ie_print wifiprinters[] = {
[1] = { "WPA", print_wifi_wpa, 2, 255, BIT(PRINT_SCAN), },
};
static inline void print_p2p(const uint8_t type, uint8_t len,
-@@ -2377,6 +2384,10 @@ static void print_vendor(unsigned char l
+@@ -2387,6 +2394,10 @@ static void print_vendor(unsigned char l
return;
}
if (len >= 4 && memcmp(data, wfa_oui, 3) == 0) {
if (data[3] < ARRAY_SIZE(wfa_printers) &&
wfa_printers[data[3]].name &&
-@@ -2576,6 +2587,7 @@ static void print_capa_non_dmg(__u16 cap
+@@ -2586,6 +2597,7 @@ static void print_capa_non_dmg(__u16 cap
printf(" ESS");
if (capa & WLAN_CAPABILITY_IBSS)
printf(" IBSS");
if (capa & WLAN_CAPABILITY_CF_POLLABLE)
printf(" CfPollable");
if (capa & WLAN_CAPABILITY_CF_POLL_REQUEST)
-@@ -2604,6 +2616,7 @@ static void print_capa_non_dmg(__u16 cap
+@@ -2614,6 +2626,7 @@ static void print_capa_non_dmg(__u16 cap
printf(" DelayedBACK");
if (capa & WLAN_CAPABILITY_IMM_BACK)
printf(" ImmediateBACK");
}
static int print_bss_handler(struct nl_msg *msg, void *arg)
-@@ -2694,8 +2707,10 @@ static int print_bss_handler(struct nl_m
+@@ -2704,8 +2717,10 @@ static int print_bss_handler(struct nl_m
else
printf("\tfreq: %d\n", freq);
}
if (bss[NL80211_BSS_BEACON_INTERVAL])
printf("\tbeacon interval: %d TUs\n",
-@@ -2889,6 +2904,7 @@ static int handle_stop_sched_scan(struct
+@@ -2899,6 +2914,7 @@ static int handle_stop_sched_scan(struct
return 0;
}
COMMAND(scan, sched_start,
SCHED_SCAN_OPTIONS,
NL80211_CMD_START_SCHED_SCAN, 0, CIB_NETDEV, handle_start_sched_scan,
-@@ -2899,3 +2915,4 @@ COMMAND(scan, sched_start,
+@@ -2909,3 +2925,4 @@ COMMAND(scan, sched_start,
COMMAND(scan, sched_stop, "",
NL80211_CMD_STOP_SCHED_SCAN, 0, CIB_NETDEV, handle_stop_sched_scan,
"Stop an ongoing scheduled scan.");