According to this TX is also possible on the ESP32-series chips, though they haven't published exactly how (I assume due they don't want to wake the FCC). But yeah the ESP32 is fairly limited in a lot of ways due to the limited processing power and IO bandwidth to stream data out of it

Like Wi-Fi chips, they don't use SDR mode during most of the normal operation. They have dedicated hardware units that do a lot of the decimation, conversion, modulation and demodulation efficiently. But the "SDR mode" is still there for things like factory calibration.

Makes me wonder how many other common MCUs and SoCs are just waiting for someone to unlock SDR in them.

TX is less "not possible" and more "this dev doesn't want to enable it" from what I gathered. Probably for "I don't want people using this to shit all over the spectrum" kinds of reasons. So you can get TX - it'll just require extra hacking.

Those hardware blocks could be useful for certain applications but most importantly for triggering captures only when there are frames to process and giving you both the frame + the sample.

So for me the perfect hack would allow both normal Wi-Fi tx/rx and triggered or continuous rx sampling.

Base stations are also SDRs by the way xD

Is the "QLink" setup they use in 5G systems now just a thin protocol running over LVDS and streaming I/Q between the transceiver and SoC DSP as digital signals?

Never actually went that far, but I did wonder if you could plug a QLink tuner chip into an FPGA to use it as a broadband SDR frontend.

The motivation for this is of course beamforming, angle of arrival, spatial streaming, etc. You connect multiple antennas with different views back to the base station.