diff --git a/components/esp_rom/esp32c5/ld/esp32c5.rom.eco3.ld b/components/esp_rom/esp32c5/ld/esp32c5.rom.eco3.ld
index e759344295f..71b74082e37 100644
--- a/components/esp_rom/esp32c5/ld/esp32c5.rom.eco3.ld
+++ b/components/esp_rom/esp32c5/ld/esp32c5.rom.eco3.ld
@@ -21,7 +21,7 @@ Cache_Set_IDROM_MMU_Size = 0x400006c4;
 hal_mac_tx_set_ppdu = 0x40000c0c;
 ic_mac_deinit = 0x40000c78;
 ic_mac_init = 0x40000c7c;
-lmacTxFrame = 0x40000cd0;
+//lmacTxFrame = 0x40000cd0;
 lmacDisableTransmit = 0x40000cd4;
 pm_check_state = 0x40000d48;
 //pm_set_beacon_filter = 0x40000d6c;
diff --git a/components/esp_rom/esp32c61/ld/esp32c61.rom.eco4.ld b/components/esp_rom/esp32c61/ld/esp32c61.rom.eco4.ld
index 65455157bdd..ab4622513ae 100644
--- a/components/esp_rom/esp32c61/ld/esp32c61.rom.eco4.ld
+++ b/components/esp_rom/esp32c61/ld/esp32c61.rom.eco4.ld
@@ -20,7 +20,7 @@ sta_input = 0x40000b3c;
 hal_mac_tx_set_ppdu = 0x40000b74;
 ic_mac_deinit = 0x40000be8;
 ic_mac_init = 0x40000bec;
-lmacTxFrame = 0x40000c40;
+//lmacTxFrame = 0x40000c40;
 lmacDisableTransmit = 0x40000c44;
 pm_check_state = 0x40000cb4;
 pm_set_beacon_filter = 0x40000cd8;
diff --git a/components/esp_wifi/include/esp_private/wifi.h b/components/esp_wifi/include/esp_private/wifi.h
index c53a28dbd4f..d95f3ffae30 100644
--- a/components/esp_wifi/include/esp_private/wifi.h
+++ b/components/esp_wifi/include/esp_private/wifi.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -846,6 +846,28 @@ void pm_beacon_offset_funcs_empty_init(void);
  */
 void esp_wifi_enable_easy_fragment(bool enable);
 
+/**
+  * @brief     Function signature for received Vendor-Specific Information Element callback with return value.
+  * @param     ctx Context argument, as passed to esp_wifi_set_vendor_ie_cb() when registering callback.
+  * @param     type Information element type, based on frame type received.
+  * @param     sa Source 802.11 address.
+  * @param     vnd_ie Pointer to the vendor specific element data received.
+  * @param     rssi Received signal strength indication.
+  */
+typedef esp_err_t (*esp_vendor_ie_cb_with_ret_t)(void *ctx, wifi_vendor_ie_type_t type, const uint8_t sa[6], const vendor_ie_data_t *vnd_ie, int rssi);
+
+/**
+  * @brief     Register Vendor-Specific Information Element monitoring callback.
+  *
+  * @param     cb   Callback function with return value
+  * @param     ctx  Context argument, passed to callback function.
+  *
+  * @return
+  *    - ESP_OK: succeed
+  *    - ESP_ERR_WIFI_NOT_INIT: WiFi is not initialized by esp_wifi_init
+  */
+esp_err_t esp_wifi_set_vendor_ie_with_ret_cb(esp_vendor_ie_cb_with_ret_t cb, void *ctx);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/components/esp_wifi/include/esp_wifi.h b/components/esp_wifi/include/esp_wifi.h
index d479b3663af..03f0161a475 100644
--- a/components/esp_wifi/include/esp_wifi.h
+++ b/components/esp_wifi/include/esp_wifi.h
@@ -813,6 +813,20 @@ esp_err_t esp_wifi_set_channel(uint8_t primary, wifi_second_chan_t second);
   */
 esp_err_t esp_wifi_get_channel(uint8_t *primary, wifi_second_chan_t *second);
 
+/**
+  * @brief     Get the home channel of device
+  *
+  * @param     primary   store primary channel
+  * @param[out]  second  store second channel
+  *
+  * @return
+  *    - ESP_OK: succeed
+  *    - ESP_ERR_WIFI_NOT_INIT: WiFi is not initialized by esp_wifi_init
+  *    - ESP_ERR_WIFI_NOT_STARTED: WiFi is not started by esp_wifi_start
+  *    - ESP_ERR_INVALID_ARG: invalid argument
+  */
+esp_err_t esp_wifi_get_home_channel(uint8_t *primary, wifi_second_chan_t *second);
+
 /**
   * @brief     configure country info
   *
diff --git a/components/esp_wifi/lib b/components/esp_wifi/lib
index cd66d383a26..cdb85041a22 160000
--- a/components/esp_wifi/lib
+++ b/components/esp_wifi/lib
@@ -1 +1 @@
-Subproject commit cd66d383a2634e2c7a1998a7d82c5ea41074c5af
+Subproject commit cdb85041a22d09dea948a3fe4975778f79c064d0