Hi Arend,
Are you saying the first result is from the Beacon and the other is from the Probe Response? Then why are the 'Information elements from Probe Response frame' the way they are?Nope. I am not saying that. I am saying that there are two probe requests being sent. One with broadcast ssid, ie. ssid_len == 0, and with ssid 'myssid'. But it is speculation without a sniffer capture.
Ah I see what you mean now. No, we traced this down to hostapd itself and it was receiving a single Probe Request with the ssid set and replying to it per spec. So I'm pretty confident this scenario isn't what is happening. Let me try to get some actual packet captures...
Regards -Denis