DJI Mavic Air 3S O4 Physical Layer: 500µs 4 ZC Burst Significance

[kiran809576]

Hi all,
I’ve isolated a recurring physical-layer burst in DJI DJI Mavic Air 3S O4 IQ captures that persists regardless of bandwidth (10/20/40 MHz) or Telemetry band settings.

Questions:
What is the significance of this packet?
Is this fixed carrier behavior universal for O4/O4+, or does it vary by firmware/regulatory profile
Thanks for any insights!

[lj411]

This seems to be a special signal frame when the drone is not connected to the controller or in standby mode.

[luyii-code-1]

I have some potentially related O4 results from an independent HackRF-based analysis:

https://github.com/luyii-code-1/dji-ocusync-droneid-research

Cross-validation thread:
luyii-code-1/dji-ocusync-droneid-research#1

On Mini 5 Pro I have recovered valid O4 AA/87 logical packets from raw IQ, with both CRC24A and DJI CRC16 passing.

An interesting observation is that at least some encrypted O4 packets in my captures can still be recovered through a classic DJI/O2-like 9-symbol PHY/FEC shell using the root-600/root-147 structure.

After FEC/CRC recovery, AA and 87 form a session-related encrypted packet pair:

AA -> SM2-compatible key material -> 16-byte note
87 -> AES-128-CTR(note) -> telemetry

There are also reports of newer O4 PHY structures with dynamic/multiple ZC symbols, so I suspect there may be more than one O4 frame shell depending on packet type, operating state, model, or firmware.

I would be interested in comparing your Air 3S 500 µs / four-ZC burst with the Mini 5 Pro AA/87 bursts to determine whether they are the same packet family or a separate O4 PHY/control frame.