Hi Ben,
The problem I see is that sometimes (and quite often when I am using lots of vdevs and thus the NIC is busy), the keys are set before the EAPOL 4/4 hits the air. When the key is set, the NIC will no longer transmit the frame because of key-length issues in the tx-descriptor (ath10k wave-2 in this case).
We have encountered something similar. In our case we were seeing PAE packets (e.g. 4WayHandshake packet 1 of 4) before seeing the connect events on nl80211.
I suspect that there is a fundamental race between the EAPOL packet-tx logic and the key-set logic, but supplicant appears to act as though they are natually synchronized.
Fundamentally there is a race between the genl/nl80211 socket to the kernel and the PAE socket that handles the authentication aspects. I think the only way to fix this is to make sure that PAE flows over the genl/nl80211 socket to preserve the proper order of events. However there are lots of dragons in the kernel side of this and we haven't been brave enough to venture into the depths yet :)
Regards, -Denis
