In hostap mode, when copying EDCA parameters into frames we send to clients, we copy EDCA parameters from the "QOS AP" table (ieee80211_qap_edca_table).
But values in these frames tell clients what parameters to use themselves. So copy parameters from the "QOS client" table (ieee80211_edca_table) instead. Index: ieee80211_output.c =================================================================== RCS file: /cvs/src/sys/net80211/ieee80211_output.c,v retrieving revision 1.115 diff -u -p -r1.115 ieee80211_output.c --- ieee80211_output.c 30 Jan 2017 18:21:13 -0000 1.115 +++ ieee80211_output.c 31 Jan 2017 08:54:48 -0000 @@ -767,7 +767,7 @@ ieee80211_add_edca_params(u_int8_t *frm, *frm++ = 0; /* reserved */ /* setup AC Parameter Records */ - edca = ieee80211_qap_edca_table[ic->ic_curmode]; + edca = ieee80211_edca_table[ic->ic_curmode]; for (aci = 0; aci < EDCA_NUM_AC; aci++) { const struct ieee80211_edca_ac_params *ac = &edca[aci]; @@ -867,7 +867,7 @@ ieee80211_add_wme_param(uint8_t *frm, st *frm++ = 0; /* reserved */ /* setup AC Parameter Records */ - edca = ieee80211_qap_edca_table[ic->ic_curmode]; + edca = ieee80211_edca_table[ic->ic_curmode]; for (aci = 0; aci < EDCA_NUM_AC; aci++) { const struct ieee80211_edca_ac_params *ac = &edca[aci];