Kestrel 8852C: noise-floor gaps — NHM reads ~25 dB high + physts SNR unparsed

[josephnef]

Follow-up to #305, which shipped the Kestrel noise-floor sensing. On the C8852B (RTL8852BU) everything works and cross-validates; on the C8852C (RTL8852CU/8832CU) both floors are deliberately gated to emit null (never a wrong value) pending two 8852C-specific fixes.

On-air comparison, same idle channel (ch149, 0 frames, DEVOURER_RX_NOISE_FLOOR=1 DEVOURER_RXQUALITY=1):

	8852BU (C8852B)	8832CU (C8852C)
active NHM floor	−93 dBm (correct)	−68 dBm (~25 dB high)
passive rssi−snr floor	−94 dBm (HEALTHY)	null (SNR unparsed)

Gap 1 — active NHM floor reads ~25 dB high on the 8852C

The halbb NHM env-monitor triggers and returns on the 8852C (setting bb->cr_type = BB_CLIENT in kestrel_halbb_create populates the CR bank so nhm_rdy is valid — the same fix that made the 8852B work), but the reported nhm_pwr is ~25 dB too high: idle ch149 reads −68 dBm vs the 8852B's −93. The nhm_pwr − 110 conversion is chip-agnostic, so the raw nhm_pwr itself differs — likely an 8852C-specific NHM reference / nhm_method_sel / threshold difference in the halbb BB_CLIENT env-monitor path (or an 8852C power-report offset the vendor applies elsewhere).

• Where it's gated: RtlKestrelDevice::GetRxEnergy() only trusts nhm_noise_floor when _variant == C8852B.
• Done looks like: the 8852C NHM floor reads a correct idle floor (~−90…−95 on a quiet channel, cross-matching the passive floor once Gap 2 lands), then drop the C8852B-only gate.

Gap 2 — physts SNR unparsed on the 8852C (passive floor null)

The passive rssi − snr floor needs per-frame SNR. devourer hand-parses it from the PPDU-status physts report: after the 8-byte physts_hdr_info, IE_01 (physts_ie_1_info) carries avg_snr at IE byte 8 [5:0]; the parse self-validates on ie_hdr == 1 at payload offset 8 (RtlKestrelDevice.cpp, the RPKT_TYPE_PPDU handler). On the 8852C the physts payload layout differs (the C uses a 16-byte drv_info unit vs the B's 8), so IE_01 is not at offset 8 → the ie_hdr == 1 guard fails → snr stays 0 → the passive floor never populates and LinkHealth misclassifies (SATURATED at a weak RSSI). Per-frame RSSI parses fine on the 8852C.

• Done looks like: locate IE_01 for the 8852C physts layout (or route the buffer through the vendored halbb_physts_parsing and read bb->bb_physts_i) so snr populates → the passive floor + LinkHealth work on the C.

Both paths currently emit null on the 8852C (no fake data), so this is a "make it work on the C" task, not a correctness regression. Context: docs/rx-spectrum-sensing.md (the per-generation noise-floor list).

[josephnef]

Gap 2 (physts SNR / passive noise floor on the 8852C) — resolved in #307 (merged).

Root cause wasn't the parse: the 8852C emitted empty physts reports. Fix (8852C-gated): run the vendor measurement inits the minimal halbb bring-up skipped (halbb_ic_hw_setting_init_8852c evm/measurement report-enable + physts CR/IE-bitmap init), and clear the R_AX_PPDU_STAT APP-prepend bits so the report is the bare physts — bit-identical to the 8852B, so the existing hand-parse works for both dies unchanged. On-air ch36: 8852C passive floor -94.8 dBm / SNR 21.5 dB, cross-matching the 8852B within 1 dB.

Gap 1 (frame-free NHM ~25 dB high on the 8852C) — remains. Confirmed it's the NHM's raw HW gain reference (the halbb SW path treats the 8852C identically to the 8852B, and the physts RSSI is correct, so the front-end gain is fine); the vendor has no 8852C NHM offset. It's a deeper RF-cal item, documented in-code (GetRxEnergy). The 8852C's absolute-floor need is now met by the working passive floor, so the frame-free NHM stays 8852B-only rather than emit a wrong value. Leaving this issue open for the NHM half.

[josephnef]

Follow-up shipped in #308: the 8852C frame-free NHM floor is now enabled on 2.4 GHz (validated -90 dBm, matches its passive floor). It stays gated on 5 GHz — characterization showed that's not a fixed offset but a bimodal AGC gain-state lock (correct ~1.5 s post-tune, then ~24 dB high; only a full set_channel re-tune resets it, and RX traffic re-drives it), so 5 GHz keeps using the passive floor. That leaves only the 5 GHz frame-free NHM as an open item, which the passive floor already covers.

[josephnef]

Both 8852C follow-ups are resolved:

• Passive floor (physts SNR) — cracked in Kestrel 8852C passive noise floor: physts measurement bring-up + bare-physts report #307: the 8852C physts measurement bring-up + a bare-physts PPDU report make the per-frame rssi−snr floor work on both bands (−94.8 dBm, cross-matches the 8852B within 1 dB).
• Frame-free NHM absolute floor — enabled on 2.4 GHz in Kestrel: enable the 8852C frame-free NHM floor on 2.4 GHz #308 (validated −90 dBm). On 5 GHz it's a firmware-DIG limitation, not a fixable offset: the fw settles the CCK PD lower-bound (0x4b74[30]=0) ~1.5 s post-tune and biases the NHM's measurement reference ~24 dB high (not a gain change — the IGI stays constant, the physts RSSI is unaffected). Root-caused and documented in docs: 8852C quirks — the frame-free NHM floor is 2.4 GHz-only (fw DIG) #309 (docs/8852c-quirks.md); a real fix would need a fw-DIG control H2C not in the ported surface, and the passive floor already covers the absolute-floor need.

Net: the 8852C has a working absolute noise floor on both bands (passive everywhere with traffic, frame-free NHM on 2.4 GHz). Closing.