Easier than you think... but there are a few twists.
Originally inspired from here: http://wiki.stocksy.co.uk/wiki/Multiple_SSIDs_with_hostapd . Also here: https://wiki.gentoo.org/wiki/Hostapd#802.11b.2Fg.2Fn_triple_AP and https://medium.com/@renaudcerrato/how-to-setup-a-virtual-ssid-with-hostapd-804c13c9a3c2 .
Ensure that the adapter is capable by checking "valid interface combinations" with iw list. Mine had:
valid interface combinations:
* #{ AP, mesh point } <= 8,
total <= 8, #channels <= 1
which is good.
According to the doc, the MAC address of the adapter needs to end with '0'. Mine ended with '8' which works as well. Maybe it needs to be changed if it ends with some number that does not end with '000' in binary.
In that case change it with systemd:
$ cat /etc/systemd/network/00-ap1.link
[Match]
MACAddress=xx:...:yz
[Link]
MACAddress=xx:...:y0
NamePolicy=kernel database onboard slot path
Filename needs to be lexically before 99-, so ap1.link will not work.
hostapd config:
Apparently the parameters wpa and others for encryption need to be repeated every time after the
ssid name, otherwise encryption will be ignored and the AP will be open to your neighbors!
interface=ap1
ssid=qwerty1
wpa=2
wpa_passphrase=secret1
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP
rsn_pairwise=CCMP
bss=ap2
ssid=asdfg2
wpa=2
wpa_passphrase=secret2
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP
rsn_pairwise=CCMP
bss=ap3
ssid=zxcvb3
wpa=2
wpa_passphrase=secret3
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP
rsn_pairwise=CCMP
...
Then after (re)starting hostapd, the additional interfaces will appear magically.