diff --git a/hostapd/wps_hostapd.c b/hostapd/wps_hostapd.c
index be1c886c6..28eec4a58 100644
--- a/hostapd/wps_hostapd.c
+++ b/hostapd/wps_hostapd.c
@@ -432,6 +432,8 @@ int hostapd_init_wps(struct hostapd_data *hapd,
 		wps->dev.sub_categ = atoi(pos);
 	}
 	wps->dev.os_version = WPA_GET_BE32(hapd->conf->os_version);
+	wps->dev.rf_bands = hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211A ?
+		WPS_RF_50GHZ : WPS_RF_24GHZ; /* FIX: dualband AP */
 
 	if (conf->wpa & WPA_PROTO_RSN) {
 		if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK)
diff --git a/src/wps/wps.h b/src/wps/wps.h
index 10725ef4f..31ec122c3 100644
--- a/src/wps/wps.h
+++ b/src/wps/wps.h
@@ -78,6 +78,7 @@ struct wps_device_data {
 	u32 oui;
 	u16 sub_categ;
 	u32 os_version;
+	u8 rf_bands; /* WPS_RF_* */
 };
 
 
diff --git a/src/wps/wps_common.c b/src/wps/wps_common.c
index 9f5116e26..7eda594ef 100644
--- a/src/wps/wps_common.c
+++ b/src/wps/wps_common.c
@@ -531,16 +531,6 @@ int wps_build_uuid_e(struct wpabuf *msg, const u8 *uuid)
 }
 
 
-int wps_build_rf_bands(struct wpabuf *msg, u8 rf_bands)
-{
-	wpa_printf(MSG_DEBUG, "WPS:  * RF Bands (%x)", rf_bands);
-	wpabuf_put_be16(msg, ATTR_RF_BANDS);
-	wpabuf_put_be16(msg, 1);
-	wpabuf_put_u8(msg, rf_bands);
-	return 0;
-}
-
-
 int wps_build_dev_password_id(struct wpabuf *msg, u16 id)
 {
 	wpa_printf(MSG_DEBUG, "WPS:  * Device Password ID (%d)", id);
@@ -616,7 +606,7 @@ struct wpabuf * wps_build_probe_req_ie(int pbc, struct wps_device_data *dev,
 	    wps_build_config_methods(ie, methods) ||
 	    wps_build_uuid_e(ie, uuid) ||
 	    wps_build_primary_dev_type(dev, ie) ||
-	    wps_build_rf_bands(ie, WPS_RF_24GHZ | WPS_RF_50GHZ) ||
+	    wps_build_rf_bands(dev, ie) ||
 	    wps_build_assoc_state(NULL, ie) ||
 	    wps_build_config_error(ie, WPS_CFG_NO_ERROR) ||
 	    wps_build_dev_password_id(ie, pbc ? DEV_PW_PUSHBUTTON :
diff --git a/src/wps/wps_dev_attr.c b/src/wps/wps_dev_attr.c
index 7ae81b44c..0d435ff85 100644
--- a/src/wps/wps_dev_attr.c
+++ b/src/wps/wps_dev_attr.c
@@ -120,6 +120,16 @@ int wps_build_os_version(struct wps_device_data *dev, struct wpabuf *msg)
 }
 
 
+int wps_build_rf_bands(struct wps_device_data *dev, struct wpabuf *msg)
+{
+	wpa_printf(MSG_DEBUG, "WPS:  * RF Bands (%x)", dev->rf_bands);
+	wpabuf_put_be16(msg, ATTR_RF_BANDS);
+	wpabuf_put_be16(msg, 1);
+	wpabuf_put_u8(msg, dev->rf_bands);
+	return 0;
+}
+
+
 static int wps_process_manufacturer(struct wps_device_data *dev, const u8 *str,
 				    size_t str_len)
 {
@@ -280,6 +290,20 @@ int wps_process_os_version(struct wps_device_data *dev, const u8 *ver)
 }
 
 
+int wps_process_rf_bands(struct wps_device_data *dev, const u8 *bands)
+{
+	if (bands == NULL) {
+		wpa_printf(MSG_DEBUG, "WPS: No RF Bands received");
+		return -1;
+	}
+
+	dev->rf_bands = *bands;
+	wpa_printf(MSG_DEBUG, "WPS: Enrollee RF Bands 0x%x", dev->rf_bands);
+
+	return 0;
+}
+
+
 void wps_device_data_dup(struct wps_device_data *dst,
 			 const struct wps_device_data *src)
 {
@@ -297,6 +321,7 @@ void wps_device_data_dup(struct wps_device_data *dst,
 	dst->oui = src->oui;
 	dst->sub_categ = src->sub_categ;
 	dst->os_version = src->os_version;
+	dst->rf_bands = src->rf_bands;
 }
 
 
diff --git a/src/wps/wps_dev_attr.h b/src/wps/wps_dev_attr.h
index e376ae364..a9c16ea22 100644
--- a/src/wps/wps_dev_attr.h
+++ b/src/wps/wps_dev_attr.h
@@ -19,11 +19,13 @@ struct wps_parse_attr;
 
 int wps_build_device_attrs(struct wps_device_data *dev, struct wpabuf *msg);
 int wps_build_os_version(struct wps_device_data *dev, struct wpabuf *msg);
+int wps_build_rf_bands(struct wps_device_data *dev, struct wpabuf *msg);
 int wps_build_primary_dev_type(struct wps_device_data *dev,
 			       struct wpabuf *msg);
 int wps_process_device_attrs(struct wps_device_data *dev,
 			     struct wps_parse_attr *attr);
 int wps_process_os_version(struct wps_device_data *dev, const u8 *ver);
+int wps_process_rf_bands(struct wps_device_data *dev, const u8 *bands);
 void wps_device_data_dup(struct wps_device_data *dst,
 			 const struct wps_device_data *src);
 void wps_device_data_free(struct wps_device_data *dev);
diff --git a/src/wps/wps_enrollee.c b/src/wps/wps_enrollee.c
index 9a122fcdb..80f1109a2 100644
--- a/src/wps/wps_enrollee.c
+++ b/src/wps/wps_enrollee.c
@@ -140,7 +140,7 @@ static struct wpabuf * wps_build_m1(struct wps_data *wps)
 	    wps_build_config_methods(msg, methods) ||
 	    wps_build_wps_state(wps, msg) ||
 	    wps_build_device_attrs(&wps->wps->dev, msg) ||
-	    wps_build_rf_bands(msg, WPS_RF_24GHZ | WPS_RF_50GHZ) ||
+	    wps_build_rf_bands(&wps->wps->dev, msg) ||
 	    wps_build_assoc_state(wps, msg) ||
 	    wps_build_dev_password_id(msg, wps->dev_pw_id) ||
 	    wps_build_config_error(msg, WPS_CFG_NO_ERROR) ||
diff --git a/src/wps/wps_i.h b/src/wps/wps_i.h
index e8fc0e19e..2c2c3641f 100644
--- a/src/wps/wps_i.h
+++ b/src/wps/wps_i.h
@@ -161,7 +161,6 @@ void wps_kdf(const u8 *key, const u8 *label_prefix, size_t label_prefix_len,
 int wps_build_public_key(struct wps_data *wps, struct wpabuf *msg);
 int wps_build_config_methods(struct wpabuf *msg, u16 methods);
 int wps_build_uuid_e(struct wpabuf *msg, const u8 *uuid);
-int wps_build_rf_bands(struct wpabuf *msg, u8 rf_bands);
 int wps_build_dev_password_id(struct wpabuf *msg, u16 id);
 int wps_build_config_error(struct wpabuf *msg, u16 err);
 int wps_derive_keys(struct wps_data *wps);
diff --git a/src/wps/wps_registrar.c b/src/wps/wps_registrar.c
index 83af80f51..7404eaf47 100644
--- a/src/wps/wps_registrar.c
+++ b/src/wps/wps_registrar.c
@@ -584,7 +584,7 @@ static int wps_set_ie(struct wps_registrar *reg)
 	    wps_build_uuid_e(probe, reg->wps->uuid) ||
 	    wps_build_device_attrs(&reg->wps->dev, probe) ||
 	    wps_build_probe_config_methods(reg, probe) ||
-	    wps_build_rf_bands(probe, WPS_RF_24GHZ /* TODO:|WPS_RF_50GHZ */)) {
+	    wps_build_rf_bands(&reg->wps->dev, probe)) {
 		wpabuf_free(beacon);
 		wpabuf_free(probe);
 		return -1;
@@ -945,7 +945,7 @@ static struct wpabuf * wps_build_m2(struct wps_data *wps)
 	    wps_build_conn_type_flags(wps, msg) ||
 	    wps_build_config_methods_r(wps->registrar, msg) ||
 	    wps_build_device_attrs(&wps->wps->dev, msg) ||
-	    wps_build_rf_bands(msg, WPS_RF_24GHZ /* TODO:|WPS_RF_50GHZ */) ||
+	    wps_build_rf_bands(&wps->wps->dev, msg) ||
 	    wps_build_assoc_state(wps, msg) ||
 	    wps_build_config_error(msg, WPS_CFG_NO_ERROR) ||
 	    wps_build_dev_password_id(msg, DEV_PW_DEFAULT) ||
@@ -983,7 +983,7 @@ static struct wpabuf * wps_build_m2d(struct wps_data *wps)
 	    wps_build_conn_type_flags(wps, msg) ||
 	    wps_build_config_methods_r(wps->registrar, msg) ||
 	    wps_build_device_attrs(&wps->wps->dev, msg) ||
-	    wps_build_rf_bands(msg, WPS_RF_24GHZ /* TODO:|WPS_RF_50GHZ */) ||
+	    wps_build_rf_bands(&wps->wps->dev, msg) ||
 	    wps_build_assoc_state(wps, msg) ||
 	    wps_build_config_error(msg, err) ||
 	    wps_build_os_version(&wps->wps->dev, msg)) {
@@ -1471,19 +1471,6 @@ static int wps_process_wps_state(struct wps_data *wps, const u8 *state)
 }
 
 
-static int wps_process_rf_bands(struct wps_data *wps, const u8 *bands)
-{
-	if (bands == NULL) {
-		wpa_printf(MSG_DEBUG, "WPS: No RF Bands received");
-		return -1;
-	}
-
-	wpa_printf(MSG_DEBUG, "WPS: Enrollee RF Bands 0x%x", *bands);
-
-	return 0;
-}
-
-
 static int wps_process_assoc_state(struct wps_data *wps, const u8 *assoc)
 {
 	u16 a;
@@ -1537,7 +1524,7 @@ static enum wps_process_res wps_process_m1(struct wps_data *wps,
 	    wps_process_config_methods(wps, attr->config_methods) ||
 	    wps_process_wps_state(wps, attr->wps_state) ||
 	    wps_process_device_attrs(&wps->peer_dev, attr) ||
-	    wps_process_rf_bands(wps, attr->rf_bands) ||
+	    wps_process_rf_bands(&wps->peer_dev, attr->rf_bands) ||
 	    wps_process_assoc_state(wps, attr->assoc_state) ||
 	    wps_process_dev_password_id(wps, attr->dev_password_id) ||
 	    wps_process_config_error(wps, attr->config_error) ||
diff --git a/wpa_supplicant/wps_supplicant.c b/wpa_supplicant/wps_supplicant.c
index 7789b0668..8a91a04c1 100644
--- a/wpa_supplicant/wps_supplicant.c
+++ b/wpa_supplicant/wps_supplicant.c
@@ -197,6 +197,8 @@ int wpas_wps_init(struct wpa_supplicant *wpa_s)
 	wps->dev.categ = WPS_DEV_COMPUTER;
 	wps->dev.oui = WPS_DEV_OUI_WFA;
 	wps->dev.sub_categ = WPS_DEV_COMPUTER_PC;
+	wps->dev.os_version = 0;
+	wps->dev.rf_bands = WPS_RF_24GHZ | WPS_RF_50GHZ;
 	os_memcpy(wps->dev.mac_addr, wpa_s->own_addr, ETH_ALEN);
 	os_memcpy(wps->uuid, wpa_s->conf->uuid, 16);