On Saturday 17 December 2016 12:14:50 Pali Rohár wrote:

I will try to play with driver if it is really truth!

I already looked into original TI's multiplatform HAL driver for
wl1251 chip (big mess) and found there that there is wl1251 command
to read mac address from chip. It could be done by this wl1251
function:

wl1251_cmd_interrogate(wl, DOT11_STATION_ID, mac, sizeof(*mac))

(same id as for setting permanent mac address, but opposite to read
it)

Confirmed! Calling that function (before setting real linux mac address) 
returns MAC address 00:00:20:07:03:09.

Changing NVS data at position 0x1c-0x21 changes also what above function 
returns.

So really at position 0x1c-0x21 in NVS data is stored MAC address (in 
reverse order). Just default is some unknown 00:00:20:07:03:09.

So MAC address is really part of NVS data.

-- 
Pali Rohár
pali.rohar@gmail.com