Step by step 1) Start scan 2) Send NULL frame with ACK request 3) Finish scan 4) WCN36XX_HAL_OTA_TX_COMPL_IND arrives. Tx complete must arrive just after bullet 2 otherwise queues are blocked.