Every other protocol here puts the source and destination in fixed places. 802.11 does not: the same octets are the destination in one direction and the BSSID in the other, decided by two bits in Frame Control eighteen octets earlier. This is the drill for that.
4 of 4 rows in this table are unverified. The answers come from the same queue as everything else — they are claims, not facts, until someone checks them against the standard.
| To DS | From DS | Address 1 | Address 2 | Address 3 | Address 4 |
|---|---|---|---|---|---|
| 0 | 0 | RA = DA | TA = SA | BSSID | — |
| 0 | 1 | RA = DA | TA = BSSID | SA | — |
| 1 | 0 | RA = BSSID | TA = SA | DA | — |
| 1 | 1 | RA | TA | DA | SA |
Cited to 802.11-2024 §9.2.4.2. Looking at it while
answering is not cheating — the point is to stop needing to.