"ESP32-C5 and the 6 GHz question: what new silicon means for the hidden-SDR story"
Last month we wrote about the undocumented IQ capture mode buried in the ESP32's Wi-Fi radio — the baseband debug path that lets firmware pull raw I/Q samples straight off the modem, bypassing the fixed-function Wi-Fi and Bluetooth blocks entirely. In receive-only terms it turns a $5 chip into a narrowband SDR across roughly 2.2–2.7 GHz, and on some newer silicon up to about 6 GHz. The discovery is now being tracked independently by Florian Euchner's ESP-SDR project (espargos.net, github.com/ESPARGOS/esp-sdr), which demonstrates live spectrum and demodulation on stock ESP32 hardware, and the writeups since have reached the usual Hacker News / Adafruit circulation. Our earlier piece stands; you don't need to reread it. What matters now is a different question: the ESP32-C5 exists, it's in mass production, and it's Espressif's first dual-band part. Does it change the deck roadmap?
What the C5 actually is
Stripped of the launch-announcement gloss, the ESP32-C5 is a single-core 240 MHz RISC-V SoC with 384 KB SRAM (plus external PSRAM support), Bluetooth 5 LE, and an 802.15.4 radio for Thread and Zigbee — the usual C-series bundle. The interesting block is the RF front end: per the product brief, it carries the first dual-band (2.4 GHz and 5 GHz) Wi-Fi 6 radio in the ESP32 line, 1T1R, covering 2412–2484 MHz and 5180–5885 MHz. 802.11ax modes are 20 MHz-only, with 20/40 MHz available on the legacy 11b/g/n side, and the top PHY rate is 150 Mbps. Backward compatibility runs through 11a/b/g/n, so the 5 GHz band includes the classic OFDM modes — that detail will matter in a moment.
It's worth being clear about what the C5 is not. It is not a 6 GHz chip: 5885 MHz is the ceiling, so the "6 GHz question" in the title is partly rhetorical — Wi-Fi 6E's 5925–7125 MHz allocation stays out of reach on this silicon. And 802.11ax at 20 MHz means no 80/160 MHz wideband capture, no 11ac 80 MHz, none of the bandwidth that makes a real 5 GHz SDR interesting for signal analysis. Espressif engineered this part for IoT duty — sensor networks, appliances, whatever — not for instrumentation.
The hidden-SDR angle
The undocumented IQ mode works because the baseband is a hardware block that sits between the ADC/RF front end and the fixed-function modems. Firmware finds a debug window and taps the stream. That architecture is not specific to single-band parts; it's how Espressif builds radios generally. So the plausible prior is that the C5's baseband exposes the same class of debug path, just with a tunable front end that covers two bands instead of one.
That's the plausible prior, and we want to be explicit that it's a prior, not a finding. Nobody has published a working raw-IQ capture on the C5 as far as we can tell — the ESP-SDR project targets the classic ESP32 family, and the recent coverage of the discovery names the 2.2–2.7 GHz (and up to 6 GHz on newer variants) behavior without a C5 demonstration. There are real reasons it might not port over. Dual-band front ends typically add a band-selection switch, sometimes external PAs/LNAs per band, and the register map driving IQ export may have been reworked around that. ESP32-S3 and other newer parts behave differently from the original ESP32 in exactly this area, so "newer silicon, same bug" has already been shown to be a shaky generalization. Until someone with a C5 dev board and a logic analyzer spends a weekend in the datasheet and the HAL, this is speculation. We'd put money on it working eventually; we would not put a shipping date on it.
If it does work, the payoff is concrete. A C5 running raw-IQ capture at 5180–5885 MHz covers the entire 5 GHz U-NII space that matters in Australia — UNII-1 through UNII-3 plus the 5.8 GHz band — with a receive-only SDR that costs less than a restaurant meal. For signal-hunting purposes that means you can finally look at what's actually on the 5 GHz band with an ESP32-form-factor device instead of hauling a HackRF or an RTL-SDR-with-upconverter to site.
What 5 GHz coverage buys in Australia
The regulatory context matters here, and it's genuinely different from the US framing most coverage assumes. In Australia, 5 GHz WLAN operation runs under the Radiocommunications (Low Interference Potential Devices) Class Licence 2025, administered by the ACMA. The shape of it: 5150–5250 MHz is in-building or covered-area only with no external antenna; 5250–5350 MHz adds mandatory DFS and TPC because that range sits near radio-navigation satellites; 5725–5855 MHz is the widest-open slice. DFS — dynamic frequency selection — is the bit that matters for RF work, because it means large parts of the 5 GHz band are occupied by radar (weather radar, defence radar) and devices must vacate on detection. A monitoring tool that can actually listen across those channels — including DFS channels that consumer gear sits on only reluctantly — sees a much more honest picture of the band than a phone's Wi-Fi scanner will ever show you.
There's also the 5.8 GHz amateur and point-to-point world, some of it adjacent to the 5725–5855 LIPD slice, plus the usual assortment of PtP backhaul links that live above 5850 and are simply invisible to anything that only does 2.4. None of this requires the C5 specifically — a HackRF covers all of it with more bandwidth and a better front end — but the C5 puts 5 GHz listening inside the same $10-ish, USB-powered, pocketable package people already accept for 2.4 GHz work. That changes what fits in a site-survey kit, and it's exactly the kind of capability we built StealthDeck Pro around: multiple ESP32-family radios, battery, USB-C, no laptop required.
Does it change the deck roadmap?
Our position: yes, but not the way the launch coverage implies.
The C5 is worth a socket on the next StealthDeck revision for three reasons, in descending order of confidence. First, even without the hidden SDR mode, a dual-band Wi-Fi 6 radio in monitor/promiscuous mode is legitimately useful — seeing 5 GHz APs, DFS state, and 11ax capabilities from the same box that's already doing 2.4 GHz capture tightens the survey workflow. Second, it keeps the deck current with where new ESP32 firmware targets are actually heading; C-series parts are what new firmware targets first, and a deck that only carries legacy silicon ages badly. Third, the option value of the undocumented mode is real — if the 5 GHz IQ path opens up, the deck inherits a 5 GHz SDR for free, which is a capability nobody else is shipping at this price.
What it does not change: the fundamental bandwidth ceiling. 20 MHz of 11ax and a 150 Mbps PHY rate mean the C5 is a narrowband scanner even in the best case, not a wideband spectrum analyzer. For anything requiring real instantaneous bandwidth — LTE/5G adjacent-channel work, wideband hopping capture, the kind of spectrum painting that needs 20+ MHz of real-time I/Q — you still want an external SDR — something like an RTL-SDR v4 kit for HF/VHF/UHF bench work — and the deck's USB host port stays the right answer for that. We're not adding an external SDR to the base product on the back of the C5 launch; that's a separate decision with a separate bill of materials.
The honest unknowns, stated plainly: whether the IQ debug path exists on C5 silicon, whether it covers both bands or just one, what the tuning granularity and sample rate are, and whether Espressif treats the whole thing as a bug to be closed in a future stepping. That last one is the strategic risk for anyone building a product on this — Espressif has so far tolerated the community's use of these debug paths without blocking them, but tolerance is not a documented API, and a mask revision that breaks the mode is entirely within their rights. Anyone building on this capability should design as if it can disappear.
The 6 GHz question, briefly
The C5's name invites a 6 GHz question it can't answer. Wi-Fi 6E and Wi-Fi 7 hardware is where 5925–7125 MHz lives, and Espressif has nothing announced in that space that we've seen. Until then, 6 GHz RF work on ESP32-family hardware stays out of reach, and the deck's 5 GHz story — if the C5's hidden mode materializes — tops out at 5885 MHz. That's a genuine limitation, not a footnote.
For now: we're putting C5 dev boards on the bench this month, and we'll report what the baseband actually exposes when we've had hands on it. The 2.4 GHz hidden-SDR story is already real. The 5 GHz chapter is a hypothesis with a credible shape and no demonstration yet — which is exactly the stage where it's most fun to be wrong in public.