IBSS mode doesn't work on QCA9888

I am trying to construct an ad-hoc network using two COMFAST CF-E313AC units. I flashed them with OpenWRT and configured them to work in IBSS mode, without using any wireless encryption. The two units don't see each other wirelessly, as each one creates a different BSSID. Here is the dmesg:

[    0.000000] Linux version 4.19.78 (ammar@ubuntu) (gcc version 8.3.0 (OpenWrt GCC 8.3.0 r11190-2b1a0f2)) #0 Sat Oct 12 10:09:02 2019
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[    0.000000] MIPS: machine is COMFAST CF-E313AC
[    0.000000] SoC: Qualcomm Atheros QCA9533 ver 2 rev 0
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] random: get_random_bytes called from start_kernel+0x98/0x4a8 with crng_init=0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16240
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 57580K/65536K available (4273K kernel code, 179K rwdata, 1008K rodata, 1188K init, 206K bss, 7956K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 650.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5880801374 ns
[    0.000009] sched_clock: 32 bits at 325MHz, resolution 3ns, wraps every 6607641598ns
[    0.008270] Calibrating delay loop... 432.53 BogoMIPS (lpj=2162688)
[    0.074882] pid_max: default: 32768 minimum: 301
[    0.080021] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.086996] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.100195] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.110646] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.117263] pinctrl core: initialized pinctrl subsystem
[    0.124043] NET: Registered protocol family 16
[    0.137157] PCI host bridge /ahb/pcie-controller@180c0000 ranges:
[    0.143684]  MEM 0x0000000010000000..0x0000000013ffffff
[    0.149182]   IO 0x0000000000000000..0x0000000000000000
[    0.181734] PCI host bridge to bus 0000:00
[    0.186165] pci_bus 0000:00: root bus resource [mem 0x10000000-0x13ffffff]
[    0.193404] pci_bus 0000:00: root bus resource [io  0x0000]
[    0.199282] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.206436] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.216286] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x101fffff 64bit]
[    0.228654] clocksource: Switched to clocksource MIPS
[    0.235601] NET: Registered protocol family 2
[    0.241233] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes)
[    0.249485] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.256846] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.263586] TCP: Hash tables configured (established 1024 bind 1024)
[    0.270496] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.276680] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.283864] NET: Registered protocol family 1
[    0.292862] Crashlog allocated RAM at address 0x3f00000
[    0.300490] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[    0.315502] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.321733] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.350232] io scheduler noop registered
[    0.354370] io scheduler deadline registered (default)
[    0.362361] pinctrl-single 1804002c.pinmux: 576 pins, size 72
[    0.369718] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.377258] console [ttyS0] disabled
[    0.381153] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[    0.390272] console [ttyS0] enabled
[    0.390272] console [ttyS0] enabled
[    0.397822] bootconsole [early0] disabled
[    0.397822] bootconsole [early0] disabled
[    0.424929] m25p80 spi0.0: w25q128 (16384 Kbytes)
[    0.429930] 5 fixed-partitions partitions found on MTD device spi0.0
[    0.436486] Creating 5 MTD partitions on "spi0.0":
[    0.441495] 0x000000000000-0x000000010000 : "u-boot"
[    0.447679] 0x000000010000-0x000000020000 : "art"
[    0.453710] 0x000000020000-0x0000007e0000 : "firmware"
[    0.463371] 2 uimage-fw partitions found on MTD device firmware
[    0.469578] Creating 2 MTD partitions on "firmware":
[    0.474714] 0x000000000000-0x0000001c0000 : "kernel"
[    0.480868] 0x0000001c0000-0x0000007c0000 : "rootfs"
[    0.486875] mtd: device 4 (rootfs) set to be root filesystem
[    0.494928] 1 squashfs-split partitions found on MTD device rootfs
[    0.501418] 0x000000450000-0x0000007c0000 : "rootfs_data"
[    0.508067] 0x0000007e0000-0x0000007f0000 : "config"
[    0.514282] 0x0000007f0000-0x000000800000 : "nvram"
[    0.521772] libphy: Fixed MDIO Bus: probed
[    0.889752] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[    1.569114] libphy: ag71xx_mdio: probed
[    1.574600] libphy: ar8xxx-mdio: probed
[    1.585193] switch0: Atheros AR8229 rev. 1 switch registered on mdio-bus.0
[    1.640531] ag71xx 1a000000.eth: connected to PHY at fixed-0:00 [uid=00000000, driver=Generic PHY]
[    1.650688] eth0: Atheros AG71xx at 0xba000000, irq 5, mode: gmii
[    1.660393] NET: Registered protocol family 10
[    1.673031] Segment Routing with IPv6
[    1.676967] NET: Registered protocol family 17
[    1.681761] 8021q: 802.1Q VLAN Support v1.8
[    2.020981] ag71xx 19000000.eth: connected to PHY at mdio-bus.0:1f:00 [uid=0000d042, driver=Generic PHY]
[    2.032009] eth1: Atheros AG71xx at 0xb9000000, irq 4, mode: mii
[    2.047751] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[    2.064854] Freeing unused kernel memory: 1188K
[    2.069578] This architecture does not have kernel memory protection.
[    2.076228] Run /sbin/init as init process
[    2.548691] random: fast init done
[    3.156713] init: Console is alive
[    3.160689] init: - watchdog -
[    4.841467] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    5.016125] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    5.034285] init: - preinit -
[    6.144508] random: jshn: uninitialized urandom read (4 bytes read)
[    6.277837] random: jshn: uninitialized urandom read (4 bytes read)
[    6.394899] random: jshn: uninitialized urandom read (4 bytes read)
[    6.878792] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    7.949875] eth0: link up (1000Mbps/Full duplex)
[    7.954700] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   10.211486] jffs2_scan_eraseblock(): End of filesystem marker found at 0x10000
[   10.219005] jffs2_build_filesystem(): unlocking the mtd device... 
[   10.219050] done.
[   10.227416] jffs2_build_filesystem(): erasing all blocks after the end marker... 
[   22.946536] done.
[   22.956334] jffs2: notice: (476) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   22.974168] mount_root: overlay filesystem has not been fully initialized yet
[   22.990354] mount_root: switching to jffs2 overlay
[   23.024541] overlayfs: upper fs does not support tmpfile.
- config restore -
[   23.379629] urandom-seed: Seed file not found (/etc/urandom.seed)
[   23.561628] eth0: link down
[   23.580468] procd: - early -
[   23.583579] procd: - watchdog -
[   24.218836] procd: - watchdog -
[   24.222518] procd: - ubus -
[   24.254667] urandom_read: 5 callbacks suppressed
[   24.254678] random: ubusd: uninitialized urandom read (4 bytes read)
[   24.275740] random: ubusd: uninitialized urandom read (4 bytes read)
[   24.284132] procd: - init -
Please press Enter to activate this console.
[   25.037762] kmodloader: loading kernel modules from /etc/modules.d/*
[   25.099207] Loading modules backported from Linux version v5.3-rc4-0-gd45331b00ddb
[   25.107039] Backport generated by backports.git v5.3-rc4-1-0-g4ec72687
[   25.187595] xt_time: kernel timezone is -0000
[   25.239279] urngd: v1.0.0 started.
[   25.375224] PPP generic driver version 2.4.2
[   25.400161] NET: Registered protocol family 24
[   25.503511] ath10k 4.19 driver, optimized for CT firmware, probing pci device: 0x56.
[   25.519906] ath10k_pci 0000:00:00.0: enabling device (0000 -> 0002)
[   25.526709] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0
[   25.592390] random: crng init done
[   25.911847] firmware ath10k!fwcfg-pci-0000:00:00.0.txt: firmware_loading_store: map pages failed
[   27.328103] ath10k_pci 0000:00:00.0: qca9888 hw2.0 target 0x01000000 chip_id 0x00000000 sub 0000:0000
[   27.337707] ath10k_pci 0000:00:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[   27.361588] ath10k_pci 0000:00:00.0: firmware ver 10.4b-ct-9888-fH-012-54863dff api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ce
[   27.812289] firmware ath10k!QCA9888!hw2.0!board-2.bin: firmware_loading_store: map pages failed
[   27.822313] ath10k_pci 0000:00:00.0: board_file api 1 bmi_id 0:24 crc32 f7733514
[   29.924984] ath10k_pci 0000:00:00.0: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
[   29.932802] ath10k_pci 0000:00:00.0: msdu-desc: 2500  skid: 32
[   29.984308] ath10k_pci 0000:00:00.0: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
[   29.995675] ath10k_pci 0000:00:00.0: wmi print 'free: 117872 iram: 23044 sram: 26020'
[   30.209592] ath10k_pci 0000:00:00.0: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-file max-sta 32 raw 0 hwcrypto 1
[   30.439565] kmodloader: done loading kernel modules from /etc/modules.d/*
[   40.955405] eth0: link up (1000Mbps/Full duplex)
[   40.961091] br-lan: port 1(eth0) entered blocking state
[   40.966511] br-lan: port 1(eth0) entered disabled state
[   40.972420] device eth0 entered promiscuous mode
[   40.995760] br-lan: port 1(eth0) entered blocking state
[   41.001253] br-lan: port 1(eth0) entered forwarding state
[   41.007097] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   41.102057] IPv6: ADDRCONF(NETDEV_UP): eth1: link is not ready
[   42.028813] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   45.833035] ath10k_pci 0000:00:00.0: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
[   45.840849] ath10k_pci 0000:00:00.0: msdu-desc: 2500  skid: 32
[   45.892128] ath10k_pci 0000:00:00.0: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
[   45.903502] ath10k_pci 0000:00:00.0: wmi print 'free: 117872 iram: 23044 sram: 26020'
[   46.197860] ath10k_pci 0000:00:00.0: Firmware lacks feature flag indicating a retry limit of > 2 is OK, requested limit: 4
[   46.209546] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
[   46.254893] ------------[ cut here ]------------
[   46.260017] WARNING: CPU: 0 PID: 1430 at target-mips_24kc_musl/linux-ath79_generic/ath10k-ct-2019-09-09-5e8cd86f/ath10k-4.19/mac.c:6598 ath10k_mac_vif_beacon_free+0xbcc/0x1070 [ath10k_core]
[   46.277511] Modules linked in: ath9k ath9k_common pppoe ppp_async iptable_nat ipt_MASQUERADE ath9k_hw ath10k_pci ath10k_core ath xt_state xt_nat xt_conntrack xt_REDIRECT xt_FLOWOFFLOAD pppox ppp_generg
[   46.335695] CPU: 0 PID: 1430 Comm: iw Not tainted 4.19.78 #0
[   46.341546] Stack : 805b0000 805649a0 00000000 00000000 805641b8 828bda24 8390ecb4 80591b67
[   46.350192]         805327a8 00000596 806e3670 000019c6 82cc8d48 00000001 828bd9d8 460a9d27
[   46.358839]         00000000 00000000 80710000 806e7de8 00000000 00000000 00000007 00000000
[   46.367474]         000000bd 6689cf37 00000000 00051f4f 80000000 00000009 00000000 82c0bc64
[   46.376123]         82c4db58 000019c6 82cc8d48 83bc4800 00000003 802c2244 00000000 806e0000
[   46.384770]         ...
[   46.387295] Call Trace:
[   46.389867] [<8006b004>] show_stack+0x58/0x100
[   46.394493] [<80086040>] __warn+0xe4/0x13c
[   46.398743] [<800860e0>] warn_slowpath_null+0x48/0x68
[   46.404019] [<82c0bc64>] ath10k_mac_vif_beacon_free+0xbcc/0x1070 [ath10k_core]
[   46.411514] ---[ end trace 4476b90ee8e90f45 ]---
[   46.830758] ath10k_pci 0000:00:00.0: NOTE:  Firmware DBGLOG output disabled in debug_mask: 0x10000000
[   49.148690] wlan0: Trigger new scan to find an IBSS to join
[   49.170967] wlan0: Trigger new scan to find an IBSS to join
[   53.148683] wlan0: Trigger new scan to find an IBSS to join
[   53.265202] wlan0: Trigger new scan to find an IBSS to join
[   53.271247] wlan0: Creating new IBSS network, BSSID 52:d1:b1:be:6d:b9
[   53.503086] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[   60.896792] ath10k_pci 0000:00:00.0: Invalid peer id 0 or peer stats buffer, peer:   (null)  sta:   (null)

Here is the output of cat /sys/kernel/debug/ieee80211/phy0/ath10k/firmware_info:

directory: ath10k/QCA9888/hw2.0
firmware:  ct-firmware-5.bin
fwcfg:     fwcfg-pci-0000:00:00.0.txt
bus:       0000:00:00.0
features:  mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,htt-mgt-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-T
version:   10.4b-ct-9888-fH-012-54863dff
hw_rev:    9888
board:     board.bin

Here is the output of sha256sum /lib/firmware/ath10k/QCA9888/hw2.0/ct-firmware-5.bin:

dcb1bd826e5e1ef266fd7ee04410b44d4474d59f6eca0cc634e6432aaf326426  /lib/firmware/ath10k/QCA9888/hw2.0/ct-firmware-5.bin

greearb / ath10k-ct

IBSS mode doesn't work on QCA9888 #101