How to patch to fully control sequence number in injected frame over Raspberry Pi4

[keyerss]

This question is similar to #202 . I used my Rpi4 with bcm43455c0 and the version of 7_45_189 to inject the frame using ioctl.c

The injected frame is QoS type so it always started from 1 instead of the sequence number I assigned.

During the research for the relative solutions, I found one particularly targeting the sequence number by patching the /net/mac80211/tx.c file and skipping renumbering it if it is an injection frame. It seems the ieee80211_tx_h_sequence is the culprit.

I attempted to follow this approach but I didn't find the tx.c in Rpi4. It seems Rpi4 uses the brcmfmac driver. If the tx.c file is unavailable, how should I apply this modification to disable the auto sequence number in my injection frame?

Originally, I tried to follow the nexmon paper that emphasizes the wlc_d11hdrs_ext and wlc_d11hdr functions to change the flags. However, they are not available in bcm43455c0.

Meanwhile, should I use the diff command to generate a similar patch file and patch it into the driver, or the kernel header? Sorry, I am a beginner to patch and kernel.

By the way, I realized there was a similar patch in utilities/nexutil/aircrack-ng/patch/mac80211
It seems to disable the auto sequence number as well. If the tx.c file is not in the Rpi4, how does this patch apply to achieve the goal?

This issue has confused me for a long period. Any guidance and suggestions are truly and sincerely appreciated.