--- /dev/null
+Date: Mon, 30 Jun 2025 16:18:21 +0200
+Subject: wifi: mt76: Fix DTS power-limits on little endian systems
+
+The power-limits for ru and mcs and stored in the devicetree as bytewise
+array (often with sizes which are not a multiple of 4). These arrays have a
+prefix which defines for how many modes a line is applied. This prefix is
+also only a byte - but the code still tried to fix the endianness of this
+byte with a be32 operation. As result, loading was mostly failing or was
+sending completely unexpected values to the firmware.
+
+Since the other rates are also stored in the devicetree as bytewise arrays,
+just drop the u32 access + be32_to_cpu conversion and directly access them
+as bytes arrays.
+
+Fixes: 22b980badc0f ("mt76: add functions for parsing rate power limits from DT")
+Fixes: a9627d992b5e ("mt76: extend DT rate power limits to support 11ax devices")
+
+--- a/eeprom.c
++++ b/eeprom.c
+@@ -273,6 +273,19 @@ mt76_get_of_array(struct device_node *np
+ return prop->value;
+ }
+
++static const s8 *
++mt76_get_of_array_s8(struct device_node *np, char *name, size_t *len, int min)
++{
++ struct property *prop = of_find_property(np, name, NULL);
++
++ if (!prop || !prop->value || prop->length < min)
++ return NULL;
++
++ *len = prop->length;
++
++ return prop->value;
++}
++
+ struct device_node *
+ mt76_find_channel_node(struct device_node *np, struct ieee80211_channel *chan)
+ {
+@@ -314,7 +327,7 @@ mt76_get_txs_delta(struct device_node *n
+ }
+
+ static void
+-mt76_apply_array_limit(s8 *pwr, size_t pwr_len, const __be32 *data,
++mt76_apply_array_limit(s8 *pwr, size_t pwr_len, const s8 *data,
+ s8 target_power, s8 nss_delta, s8 *max_power)
+ {
+ int i;
+@@ -323,15 +336,14 @@ mt76_apply_array_limit(s8 *pwr, size_t p
+ return;
+
+ for (i = 0; i < pwr_len; i++) {
+- pwr[i] = min_t(s8, target_power,
+- be32_to_cpu(data[i]) + nss_delta);
++ pwr[i] = min_t(s8, target_power, data[i] + nss_delta);
+ *max_power = max(*max_power, pwr[i]);
+ }
+ }
+
+ static void
+ mt76_apply_multi_array_limit(s8 *pwr, size_t pwr_len, s8 pwr_num,
+- const __be32 *data, size_t len, s8 target_power,
++ const s8 *data, size_t len, s8 target_power,
+ s8 nss_delta, s8 *max_power)
+ {
+ int i, cur;
+@@ -339,8 +351,7 @@ mt76_apply_multi_array_limit(s8 *pwr, si
+ if (!data)
+ return;
+
+- len /= 4;
+- cur = be32_to_cpu(data[0]);
++ cur = data[0];
+ for (i = 0; i < pwr_num; i++) {
+ if (len < pwr_len + 1)
+ break;
+@@ -355,7 +366,7 @@ mt76_apply_multi_array_limit(s8 *pwr, si
+ if (!len)
+ break;
+
+- cur = be32_to_cpu(data[0]);
++ cur = data[0];
+ }
+ }
+
+@@ -366,7 +377,7 @@ s8 mt76_get_rate_power_limits(struct mt7
+ {
+ struct mt76_dev *dev = phy->dev;
+ struct device_node *np;
+- const __be32 *val;
++ const s8 *val;
+ char name[16];
+ u32 mcs_rates = dev->drv->mcs_rates;
+ u32 ru_rates = ARRAY_SIZE(dest->ru[0]);
+@@ -412,21 +423,21 @@ s8 mt76_get_rate_power_limits(struct mt7
+
+ txs_delta = mt76_get_txs_delta(np, hweight16(phy->chainmask));
+
+- val = mt76_get_of_array(np, "rates-cck", &len, ARRAY_SIZE(dest->cck));
++ val = mt76_get_of_array_s8(np, "rates-cck", &len, ARRAY_SIZE(dest->cck));
+ mt76_apply_array_limit(dest->cck, ARRAY_SIZE(dest->cck), val,
+ target_power, txs_delta, &max_power);
+
+- val = mt76_get_of_array(np, "rates-ofdm",
+- &len, ARRAY_SIZE(dest->ofdm));
++ val = mt76_get_of_array_s8(np, "rates-ofdm",
++ &len, ARRAY_SIZE(dest->ofdm));
+ mt76_apply_array_limit(dest->ofdm, ARRAY_SIZE(dest->ofdm), val,
+ target_power, txs_delta, &max_power);
+
+- val = mt76_get_of_array(np, "rates-mcs", &len, mcs_rates + 1);
++ val = mt76_get_of_array_s8(np, "rates-mcs", &len, mcs_rates + 1);
+ mt76_apply_multi_array_limit(dest->mcs[0], ARRAY_SIZE(dest->mcs[0]),
+ ARRAY_SIZE(dest->mcs), val, len,
+ target_power, txs_delta, &max_power);
+
+- val = mt76_get_of_array(np, "rates-ru", &len, ru_rates + 1);
++ val = mt76_get_of_array_s8(np, "rates-ru", &len, ru_rates + 1);
+ mt76_apply_multi_array_limit(dest->ru[0], ARRAY_SIZE(dest->ru[0]),
+ ARRAY_SIZE(dest->ru), val, len,
+ target_power, txs_delta, &max_power);