How do I cycle a WiFi transmitter through all modes, for FCC intentional radiator EMC testing?
In the end, the module maker supplied fw_bcm43341b0_ag_mfg.bin , a Broadcom test firmware, which could be controlled by Linux commands such as:

wl down
wl band b
wl mpc 0
wl nrate -r 11
wl rateset 11b
wl country ALL
wl up
wl channel 1
wl scansuppress 1
wl txpwr1 -1
wl phy_forcecal 1
wl pkteng_start 00:11:22:33:44:55 tx 100 1000 0 


It was... very... tedious...