As I know BSSID is derived from MAC Address, but I have no idea how it is derived and what pattern is used. Since there might be multiple BSSIDs from a device, I want to get all the BSSID that could be generated from the device, therefore I hope to understand the pattern of how BSSID is derived from a MAC Address.
As I know BSSID is derived from MAC Address, but I have no idea how it is derived and what pattern is used.
It is possible, but not any sort of requirement. It is simply often just easier for vendors to assign consecutive addresses from their OUI space for use in the access point.
But there it is possible and even likely that there is no correlation for example between the wired MAC address and the addresses used by the AP for BSSIDs.
As such, there is no "pattern" as how a manufacturer chooses to use their OUI addresses is entirely up to them and each vendor may do it differently.