Yes, so different SoC, same WiFi, same issues, isolating the issues to the WiFi chip (common denominator). Carrier was also ruled out since I tried a custom and Raspberry offical one.

No, i mean the problem could be in the Wireless FW, not Wireless chip, which mean it can be patched.

I wonder how feasible decompilation is. The firmware is used in many boards. An open, cleanroom reimplementation (derriving hardware details from the firmware, then reimplementing cleanly in embedded C++ or rust) could fix the issues, that would be very interesting.

It's feasible, in fact i'm in process of decompiling a bluetooth blob from other vendor. But the thing is it's just Bluetooth, Wifi is vastly more complex than BT.