On 9/27/2024 7:53 PM, James Prestwood wrote: >> here is the sequence I saw in sniffer: >> #1 AP send M3 >> #2 station send 'neighbor report request' without encryption, though 'protected' flag is set >> #3 station send out M4 >> >> is this the same with what you saw? > When I was able to capture the neighbor report request (rarely) it was after M4, not before. If you're seeing it prior to M4 that seems strange, unless the kernel/ath11k is doing some odd queuing? yeah... firmware has some odd assumption on the sequence of key install, causing such behavior.