I own a Nexus 7 (2012) and it is possible with this tablet to run a software called 'bcmon' that will put the wifi chipset in monitor mode and let you inject de-auth frame to capture WPA handshakes. This is only supposed to work on kitkat but thanks to a simple tweak I got it running on lollipop.
You can go to the GitHub's page and get the release if you own any of the devices that are supported by 'bcmon'.
Now my question is: why is this working on lollipop and not on marshmallow ?
unlegacy android is out with kernel 3.4 and it is possible to install nethunter... you see where I am going: kali linux + frame injection on native wifi card.
The issues on marshmallow is that even though 'bcmon' application runs well, the binaries that come with it run empty, no access points are detected with softwares like besside-ng or airodump.
EDIT:
Comes from the 3.4 kernel, at which point I don't know but I flashed the unlegacy one on Lollipop and the issue is the same now than with marshmallow
bcmon
AFAIK requires a Broadcom Wifi chipset. However the Nexus 7 2012 has an AzureWave AW-NH665 (according to iFixit teardown.