diff --git a/bes2600/scan.c b/bes2600/scan.c
index a81afb6..497523b 100644
--- a/bes2600/scan.c
+++ b/bes2600/scan.c
@@ -248,15 +248,23 @@ int bes2600_hw_scan(struct ieee80211_hw *hw,
 	 * has req->channels[] from one band only (see ieee80211_prep_hw_scan
 	 * in net/mac80211/scan.c).  Refuse the 5 GHz iteration at the driver
 	 * boundary so userspace gets a clean aborted-scan for that portion
-	 * rather than waiting for the firmware reject to cascade up.  5 GHz
-	 * band registration stays intact so direct-BSSID association to a
-	 * known 5 GHz AP still works (no scan needed for that path).
+	 * rather than waiting for the firmware reject to cascade up.
+	 *
+	 * Only the multi-channel case is refused (n_channels > 1): that's
+	 * the per-band-sweep pattern mac80211 issues internally and the
+	 * one that triggers the firmware storm at the per-band loop
+	 * boundary.  Single-channel 5 GHz scans (BSS verification, NM's
+	 * per-freq iteration when 802-11-wireless.band=a is set) pass
+	 * through to firmware, which generally accepts them since the
+	 * storm is the back-to-back per-band issue, not a blanket 5 GHz
+	 * reject.  This preserves 5 GHz association via the
+	 * "wpa_supplicant iterates freq_list per channel" path.
 	 *
 	 * Contract: per include/net/mac80211.h struct ieee80211_ops.hw_scan
 	 * documentation, a negative return aborts the scan without requiring
 	 * ieee80211_scan_completed().
 	 */
-	if (req->n_channels > 0 &&
+	if (req->n_channels > 1 &&
 	    req->channels[0]->band == NL80211_BAND_5GHZ)
 		return -EOPNOTSUPP;