Xbee S1 PRO broadcast issue

Hi all, I’ve an issue with XBee S1 PRO when used to send broadcast packets in 802.15.4.
In simple words, this is my configuration:

TRANSMITTER = Xbee S1 PRO ($10EF - latest available)
Starting from default parameters I’ve changed:
MM = $03
CE = $00
A1 = $00
A2 = $00
ID = $1204
MY = $1601
DH = $00000000
DL = $0000FFFF
RR = $00
PL = $04
CA = $24
CH = $10

RECEIVER = Xbee3 ($2012 - latest available)
Starting from default parameters I’ve changed:
D0 = $00
D5 = $00
D8 = $00
D9 = $00
IU = $00
MM = $03
CE = $00
A1 = $00
A2 = $00
ID = $1204
MY = $1601
DH = $00000000
DL = $0000FFFF
RR = $00
PL = $04
CA = $00

At this point transmitter send, every 300ms, a packet with:

; TX Request: 16- bit address- 0x01 (Xbee3 802.15.4 RF Manual User Guide - pag 194)
;
; Frame Type : API TX Request: 16-bit address - 0x01
; Frame ID : 0
; 16-bit dest.address : Broacast - 0x0FFFF
; Options : B00.1 = Disable MAC ACK
; : B02.1 = Send packet with Broadcast PAN ID
$7E $00 $24 $01 $00 $FF $FF $05

The TRASMITTER use, in this description, always fixed the channel CH $10.
In the RECEIVER I can reset all and try any channel.

Well, what I’ve found is that XBee3 strangely receive data from TRASMITTER
with a different channel in this scheme:

TRASMITTER CH   = 10

RECEIVER CH     = ...
                = $0C   Correctly does not receive nothing
                = $0D   Correctly does not receive nothing
                = $0E   WRONG!!! Receive the packet but is not the same TRANSMITTER channel
                = $0F   Correctly does not receive nothing
                = $10   RIGHT!!! Correctly receive (it's right channel)
                = $11   Correctly does not receive nothing
                = $12   WRONG!!! Receive the packet but is not the same TRANSMITTER channel    
                = $13   Correctly does not receive nothing
                = $14   Correctly does not receive nothing
                = ...

So receiver, get packets also in different channels than transmitter (-2 CH and +2 CH offset from transmitter CH).

PS: if for TRASMITTER I use an XBee3 module instead of XBee PRO S1, all works fine.

UPDATE: Placing 0x01 Options.B02 to 0 (packet with Broadcast PAN ID) the XBee PRO S1,
stops to send ghost packets on -2 and +2 channels (adiacent to programmed CH).

I don’t know reasons of ghost packets… just a (dummy)fix after many tests changing any possibile parameter.

why are you sending a broadcast packet to ALL PAN ID’s?