See sbin/ifconfig/ifieee80211.c and sbin/ifconfig/ifconfig.8
The list_scan() code uses getcaps() and printies().
The list_stations() code uses getcaps() and getflags() and printies().
For example: getcaps has A as CAPINFO_CHNL_AGILITY, E is CAPINFO_ESS, and P is CAPINFO_PRIVACY;
and getflags has A as NODE_AUTH, E is NODE_ERP, and P is NODE_PWR_MGT.
The manpage has multiple problems.
The list scan section has "Depending on the capabilities of the stations the following flags can be included in the output:" But it lists A as Authjorized, E as ERP, P as Powersave, etc. This has the getflags stuff and not capabiltiies.
If you want you may consider some content or hints from the following:
A -- Channel Agility allows channel switching or frequency hopping.
B -- Packet Binary Convolutional Code (PBCC) mode provides error correction to help improve performance. Nevertheless, newer technologies have faster rates.
c -- Contention-free (CF) pollable uses Point coordination function (PCF) and is able to participate in its QoS.
C -- CF Pollable Request
D -- This 802.11g feature provides both direct-sequence spread spectrum (DSSS) and Orthogonal frequency-division multiplexing (OFDM) methods.
E -- Extended Service Set (ESS). Infrastructure mode providing an Access Point where devices can communicate with each other. (It may have more than one AP for roaming.)
I -- Independent Basic Service Set (IBBS) is an ad-hoc network with no access point. (It can only connect to one station at a time.)
P -- Wired Equivalent Privacy (WEP). This is weak security that has been superseded by WPA.
R -- Robust Security Network (RSN) encrypts the whole frame. This is WPA2.
s -- Short Slot Times reduce retransmission delay after collisions to increase throughput.
S -- Short Preambles have reduced packet headers to improve performance. Old devices require long preambles. This is a 802.11g feature.
Other problems are in the "list sta" section where it documents flags.
S as "Short Preamble" but code is about "Short GI in HT40 enabled". (I think is different.):
T as "Transitional Security Network (TSN)" but code is about "AMPDU tx enabled".
(I think that is wrong.)
(I noticed all this as I originally saw mistakes in pfSense wireless stats page and realized the upstream manual page also had mistakes. I am authoring a very detailed book about pfSense. http://reedmedia.net/books/pfsense/ )