[Sony Xperia T, TL, TX, V] bolillo:
After turning off airplane mode i found that more frquencies opened up but some were still disabled.

u0_a250@android:/ $ iw phy0 info

Wiphy phy0

Band 1:

Capabilities: 0x9030

HT20

Static SM Power Save

RX Greenfield

RX HT20 SGI

No RX STBC

Max AMSDU length: 3839 bytes

DSSS/CCK HT40

L-SIG TXOP protection

Maximum RX AMPDU length 65535 bytes (exponent: 0x003)

Minimum RX AMPDU time spacing: 16 usec (0x07)

HT TX/RX MCS rate indexes supported: 0-7

Frequencies:

* 2412 MHz [1] (20.0 dBm)

* 2417 MHz [2] (20.0 dBm)

* 2422 MHz [3] (20.0 dBm)

* 2427 MHz [4] (20.0 dBm)

* 2432 MHz [5] (20.0 dBm)

* 2437 MHz [6] (20.0 dBm)

* 2442 MHz [7] (20.0 dBm)

* 2447 MHz [8] (20.0 dBm)

* 2452 MHz [9] (20.0 dBm)

* 2457 MHz [10] (20.0 dBm)

* 2462 MHz [11] (20.0 dBm)

* 2467 MHz [12] (disabled)

* 2472 MHz [13] (disabled)

* 2484 MHz [14] (disabled)

Bitrates (non-HT):

* 1.0 Mbps

* 2.0 Mbps

* 5.5 Mbps

* 11.0 Mbps

* 6.0 Mbps

* 9.0 Mbps

* 12.0 Mbps

* 18.0 Mbps

* 24.0 Mbps

* 36.0 Mbps

* 48.0 Mbps

* 54.0 Mbps

Band 2:

Capabilities: 0x9072

HT20/HT40

Static SM Power Save

RX Greenfield

RX HT20 SGI

RX HT40 SGI

No RX STBC

Max AMSDU length: 3839 bytes

DSSS/CCK HT40

L-SIG TXOP protection

Maximum RX AMPDU length 65535 bytes (exponent: 0x003)

Minimum RX AMPDU time spacing: 16 usec (0x07)

HT TX/RX MCS rate indexes supported: 0-7

Frequencies:

* 5180 MHz [36] (17.0 dBm)

* 5200 MHz [40] (17.0 dBm)

* 5220 MHz [44] (17.0 dBm)

* 5240 MHz [48] (17.0 dBm)

* 5260 MHz [52] (20.0 dBm) (radar detection)

* 5280 MHz [56] (20.0 dBm) (radar detection)

* 5300 MHz [60] (20.0 dBm) (radar detection)

* 5320 MHz [64] (20.0 dBm) (radar detection)

* 5500 MHz [100] (20.0 dBm) (radar detection)

* 5520 MHz [104] (20.0 dBm) (radar detection)

* 5540 MHz [108] (20.0 dBm) (radar detection)

* 5560 MHz [112] (20.0 dBm) (radar detection)

* 5580 MHz [116] (20.0 dBm) (radar detection)

* 5600 MHz [120] (disabled)

* 5620 MHz [124] (disabled)

* 5640 MHz [128] (disabled)

* 5660 MHz [132] (20.0 dBm) (radar detection)

* 5680 MHz [136] (20.0 dBm) (radar detection)

* 5700 MHz [140] (20.0 dBm) (radar detection)

* 5745 MHz [149] (30.0 dBm)

* 5765 MHz [153] (30.0 dBm)

* 5785 MHz [157] (30.0 dBm)

* 5805 MHz [161] (30.0 dBm)

* 5825 MHz [165] (30.0 dBm)

Bitrates (non-HT):

* 6.0 Mbps

* 9.0 Mbps

* 12.0 Mbps

* 18.0 Mbps

* 24.0 Mbps

* 36.0 Mbps

* 48.0 Mbps

* 54.0 Mbps

max # scan SSIDs: 9

max scan IEs length: 200 bytes

Coverage class: 0 (up to 0m)

Supported interface modes:

* IBSS

* managed

* AP

* P2P-client

* P2P-GO

Supported commands:

* new_interface

* set_interface

* new_key

* new_beacon

* new_station

* set_bss

* join_ibss

* remain_on_channel

* action

* Unknown command (67)

* set_channel

* connect

* disconnect

Supported TX frame types:

* managed: 0x0000 0x0010 0x0020 0x0030 0x0040 0x0050 0x0060 0x0070 0x0080 0x0090 0x00a0 0x00b0 0x00c0 0x00d0 0x00e0 0x00f0

* AP: 0x0000 0x0010 0x0020 0x0030 0x0040 0x0050 0x0060 0x0070 0x0080 0x0090 0x00a0 0x00b0 0x00c0 0x00d0 0x00e0 0x00f0

* P2P-client: 0x0000 0x0010 0x0020 0x0030 0x0040 0x0050 0x0060 0x0070 0x0080 0x0090 0x00a0 0x00b0 0x00c0 0x00d0 0x00e0 0x00f0

* P2P-GO: 0x0000 0x0010 0x0020 0x0030 0x0040 0x0050 0x0060 0x0070 0x0080 0x0090 0x00a0 0x00b0 0x00c0 0x00d0 0x00e0 0x00f0

Supported RX frame types:

* managed: 0x0040 0x00d0

* AP: 0x0000 0x0020 0x0040 0x00a0 0x00b0 0x00c0 0x00d0

* P2P-client: 0x0040 0x00d0

* P2P-GO: 0x0000 0x0020 0x0040 0x00a0 0x00b0 0x00c0 0x00d0

u0_a250@android:/ $