Finding out which wifi AP the device used to access the network

You are a bit confused about the nature of addresses in 802.11 frames. Since your question isn't actually about the address fields, let me address that first and then go into the details on the address fields later in my answer if you are interested.

Most devices to which you are referring (whether they are call boosters, repeaters, extenders, etc) don't actually play a part in 802.11 as either a station or part of the distribution system (DS, also most commonly the access point or AP). They are simply devices that listen for and then repeat a signal.

For example, let's say Bob and Bill need to pass a message by radio. Unfortunately, they are too far apart (or maybe there is a mountain range in between) so they cannot reach each other directly. Ben happens to be in the middle (or on the top of the mountain) and since Bob and Bill can't directly talk to each other, Ben offers to repeat their messages so they can communicate.

So when Bob says "Hey, Bill, how are you?" on his radio, Ben hears it and then repeats it back into the air and Bill then gets the message. Any replies from Bill are handled the same way. Ben is not the source, the destination, or the intended receiver of the message. He doesn't really directly play a part in the conversation at all. This is the same process a "booster" will typically use on a 802.11 network.

The way the address fields are used in an 802.11 header is determined by the status of the "To DS" and "From DS" flags.

Address 1 will always be the receiver address (RA) and address 2 will always be the transmitter address (TA). This provides a consistent way for radios to easily determine if they need to receive the frame.

If neither of the "To DS" or "From DS" flags are set, this is a management or "station to station" frame. In these cases, address 1 is is the destination address (DA) in addition to the RA. Address 2 is the source address (SA) in addition to the TA. Address 3 would contain the BSSID (so radios not in the BSS can filter it) or be set to broadcast (all F's). Address 4 is unused.

If only the "To DS" flag is set, this is a frame bound from a station to a DS. In this case, address 1 is both the RA and the BSSID, address 2 will be both the TA and the SA, and address 3 will be the DA. This makes sense as while the station needs to send the frame to the DS, it is actually destined for some other host on the network and not for the DS.

If only the "From DS" flag is set, this would be a frame from the DS (or AP) to a station. Address 1 will be both the RA and the DA, address 2 will be both the TA and BSSID, and address 3 will be the SA. Again this makes sense as while the DS is transmitting the frame, it was sourced from another device on the network.

If both the "To DS" and "From DS" flags are set, this would be frames sent from one DS to another DS, such as you would find when using wireless access points to bridge traffic for other devices. Address 1 will only be the RA, address 2 will only be the TA, address 3 will only be the DA and address 4 will only be the SA.

Wifi Channel 6 is centered at 2437Mhz and is 22Mhz large, so ranging from 2426 to 2448 as you stated (well that would rather be 23Mhz large, so not sure if it is 2427-2448 or 2426-2447).

But data is actually transmitted along a 20 MHz bandwidth, the remaining 2Mhz are used as a guard band so there's enough attenuation along the edge channel.

So there's no data transmitted at 2426 Mhz when using Wifi Channels 1 or 6 (1, 6 and 11 are the most used since they are non-overlapping)

From Argenox

LE uses 40 1MHz wide channels, numbered 0 to 39. Each is separated by 2MHz.

Channels 37, 38, and 39 are used only for sending advertisement packets. The rest are used for data exchange during a connection. We’re interested in what’s happening in these 3 channels, and that’s what we’ll cover here.

During BLE advertisement, a BLE Peripheral device transmits packets on the 3 advertising channels one after the other. A Central device scanning for devices or beacons will listen to those channels for the advertising packets, which helps it discover devices nearby.

Channels 37, 38 and 39 are spread across the 2.4GHz spectrum on purpose. 37 and 39 are the first and last channels in the band, while 38 is in the middle. If any single advertising channel is blocked, the other channels are likely to be free since they’re separated by quite a few MHz of bandwidth.

This is especially true since most other devices that interfer with BLE are narrow band. Channel 38 in particular was placed between Wi-Fi channels 1 and 6 so it avoids the Wi-Fi signal. The wide spacing of the advertisement channels helps BLE better manage the interference from Wi-Fi, Classic Bluetooth, Microwaves, Baby Monitors, etc to ensure that advertisements succeed.

You may find this study relevant to your question:

Coexistence and Interference Tests on a Bluetooth Low Energy Front-End

Here are some parts:

On other hand Wi-Fi signals will see Bluetooth as narrow band interference and only in the cases that the Bluetooth interference is not more than 10 dB below the Wi-Fi signal can occasionally cause interference. In most cases Wi-Fi transmits 20 dBm and Bluetooth transmits 0 dBm so if we take into account the path loss Friis equation of the transmitted Wi-Fi signal

Lpath= −27.55dB +20 log (2.4MHz ) +20×log[dist(m)]

and the Link Budget equation

Received Power (dBm) = Transmitted Power (dBm) + Gains (dB) − Losses (dB) − Lpath

We get to the theoretically conclusion that only if the Wi-Fi Router is more than 3 meters away from the connecting equipment and the Bluetooth equipment is on a 3 meters area around the Wi-Fi equipment, that occasionally the Bluetooth signal can cause interference over the Wi-Fi

The study conclude that:

C. Coexistence with Wi-Fi Due to their dependence on the same band, the potential for interference exists. Therefore it is important to see if there is interference from Wi-Fi on the BLE transmissions. The results show no effect on the Bit Error Rate or RSSI readout, in fact the RSSI readout shows that the value increases. The results obtained show that BLE hopping is effectively avoiding the Wi-Fi occupy channels, therefore there is very good coexistence between BLE and Wi-Fi.