Problem with WPA-PSK TKIP on WRT54G V5

[Larry Finger]

I am using WPA-PSK TKIP on a Linksys WPC54G interface connecting to a Linksys WRT54G. I run SuSE 
10.0 Linux with the bcm43xx/softmac driver that is under development. I use the wext interface to 
wpa_supplicant. It was working until my WRT54G V1 AP died and I replaced it with a V5 model. Now I 
can connect if I use ndiswrapper, but bcm43xx no longer works.

When I run wpa_supplicant in the foreground with -dd, I see the following output:

Scan results: 3
Selecting BSS from priority group 3
0: <MAC address of AP> ssid=<my essid> wpa_ie_len=26 rsn_ie_len=0 caps=0x11
Trying to associate with <MAC address of AP> (SSID=<my essid> freq=0 Mhz)
Cancelling scan result
WPA: clearing own WPA/RSN IE
Automatic auth_alg selection: 0x1
WPA: using IEEE 802.11i/D3.0
WPA: Selected cipher suites: group 8 pairwise 8 key_mgmt 2
WPA: set AP WPA IE - hexdump(len=26): dd 18 00 50 f2 01 01 00 00 50 f2 02 01 00 00 50 f2 02 01 00 00 
50 f2 02 00 00
WPA: clearing AP RSN IE
WPA: using GTK TKIP
WPA: using PTK TKIP
WPA: using KEY_MGMT WPA-PSK
WPA: Set own WPA IE default - hexdump(len=24): dd 16 00 50 f2 01 01 00 00 50 f2 02 01 00 00 50 f2 02 
01 00 00 50 f2 02
No keys have been configured - skip key clearing
wpa_driver_wext_set_drop_unencrypted
State:SCANNING -> ASSOCIATING
wpa_driver_wext_associate
Setting authentication timeout: 10 sec 0 usec
EAPOL: External notification - EAP success = 0
EAPOL: External notification - EAP fail = 0
EAPOL: External notification - portControl = Auto
Wireless event: cmd=0x8b06 len=8          <---- SIOCSIWMODE
Wireless event: cmd=0x8b1a len=15         <---- SIOCSIWESSID
Wireless event: cmd=0x8c02 len=21         <---- IWEVCUSTOM
Custom wireless event: 'authenticated'
Wireless event: cmd=0x8c02 len=21         <---- IWEVCUSTOM
Custom wireless event: 'scan finished'
Wireless event: cmd=0x8c02 len=26         <---- IWEVCUSTOM
Custom wireless event: 'associating failed'
Authentication with 00:00:00:00:00:00 timed out.
Added 00:00:00:00:00:00 into blacklist
State: ASSOCIATED -> SCANNING
Starting AP scan (broadcast SSID)

and it loops until stopped. Meanwile softmac is getting 'invalid pairwise cipher when associating' 
messages. I never never get any RX EAPOL events with bcm43xx, nor does it ever get into the 
4WAY_HANDSHAKE state. Obviously, the new AP is responding differently than did the old one and the 
softmac stack cannot handle the differences, but I haven't a clue where to look. Can anyone suggest 
what to look for in the data to/from the AP?

Thanks,

Larry