linksys WRT54GX2 replay counter bug?

[Chuck T.]

I'm having a problem with wpa_supplicant and a WRT54GX2 w/ the latest 
firmware.  Sometimes it works, but most of the time the reply_counter of "RX 
message 1 of Group Key Handshake" is the same as that of the "RX message 3 
of 4-Way Handshake".  As a result wpa_supplicant fails (correctly) with a 
"WPA: EAPOL-Key Replay Counter did not increase - dropping packet" error.

When it works the reply_counter advance by 1 between the 4-Way handshake 
rather than the 2 that the spec appears to require.  I also have a WRT54G 
(non x2) which works correctly every time and does advance the reply_counter 
by 2.

Has anyone run into this problem or similar problems?

TIA.