Apple AirPort Express: cannot associate?

[Chris Boot]

All,

I have an Apple AirPort Express (http://www.apple.com/airportexpress/)
that I use to stream music from iTunes to my HiFi wirelessly. Or, I used
to until I stopped using it as an AP and build a dedicated router with a
Wistron CM9 (Atheros AR5212 802.11abg). The device seems unable to
associate with my AP no matter how hard I try (hostapd.conf below).
I've tried with various combinations of wpa (1,2,3), wpa_pairwise (CCMP,
TKIP, or both), stakey, and now I've just about given up. My
Windows/Linux box, PowerBook, and various other machines all associate
and work just fine, but the AirPort Express simply refuses to connect
altogether. It's running the latest firmware. I've got a log taking 
using hostapd -dd but it's too big to attach.

Debian 4.0
Madwifi SVN 2263 (have been trying for months and months with all sorts
of versions prior to this one)
Hostapd 0.5.5-3.1 (have been trying since 0.5.1 was in testing)
Linux 2.6.20.6 (home-built, I have modules for custom hardware)
Wireless-tools 28-1

These are the messages I see in syslog:

Jun  9 21:15:14 piccolo hostapd: ath0: STA 00:11:24:01:72:25 IEEE
802.11: associated
Jun  9 21:15:14 piccolo hostapd: ath0: STA 00:11:24:01:72:25 WPA:
received EAPOL-Key 2/4 Pairwise with unexpected replay counter
Jun  9 21:15:17 piccolo hostapd: ath0: STA 00:11:24:01:72:25 WPA:
received EAPOL-Key 2/4 Pairwise with unexpected replay counter
Jun  9 21:15:17 piccolo hostapd: ath0: STA 00:11:24:01:72:25 IEEE
802.11: deauthenticated due to local deauth request
Jun  9 21:15:17 piccolo hostapd: ath0: STA 00:11:24:01:72:25 IEEE
802.11: disassociated
Jun  9 21:15:18 piccolo hostapd: ath0: STA 00:11:24:01:72:25 IEEE
802.11: associated
Jun  9 21:15:20 piccolo hostapd: ath0: STA 00:11:24:01:72:25 WPA:
received EAPOL-Key 2/4 Pairwise with unexpected replay counter
Jun  9 21:15:22 piccolo hostapd: ath0: STA 00:11:24:01:72:25 WPA:
received EAPOL-Key 2/4 Pairwise with unexpected replay counter
Jun  9 21:15:22 piccolo hostapd: ath0: STA 00:11:24:01:72:25 IEEE
802.11: deauthenticated due to local deauth request
Jun  9 21:15:22 piccolo hostapd: ath0: STA 00:11:24:01:72:25 IEEE
802.11: disassociated
Jun  9 21:15:23 piccolo hostapd: ath0: STA 00:11:24:01:72:25 IEEE
802.11: associated
Jun  9 21:15:25 piccolo hostapd: ath0: STA 00:11:24:01:72:25 WPA:
received EAPOL-Key 2/4 Pairwise with unexpected replay counter
Jun  9 21:15:27 piccolo hostapd: ath0: STA 00:11:24:01:72:25 WPA:
received EAPOL-Key 2/4 Pairwise with unexpected replay counter
Jun  9 21:15:27 piccolo hostapd: ath0: STA 00:11:24:01:72:25 IEEE
802.11: deauthenticated due to local deauth request
Jun  9 21:15:27 piccolo hostapd: ath0: STA 00:11:24:01:72:25 IEEE
802.11: disassociated
Jun  9 21:15:28 piccolo hostapd: ath0: STA 00:11:24:01:72:25 IEEE
802.11: associated
Jun  9 21:15:30 piccolo hostapd: ath0: STA 00:11:24:01:72:25 WPA:
received EAPOL-Key 2/4 Pairwise with unexpected replay counter
Jun  9 21:15:32 piccolo hostapd: ath0: STA 00:11:24:01:72:25 WPA:
received EAPOL-Key 2/4 Pairwise with unexpected replay counter
Jun  9 21:15:32 piccolo hostapd: ath0: STA 00:11:24:01:72:25 IEEE
802.11: deauthenticated due to local deauth request
Jun  9 21:15:32 piccolo hostapd: ath0: STA 00:11:24:01:72:25 IEEE
802.11: disassociated

hostapd.conf:
interface=ath0
bridge=br0
driver=madwifi
logger_syslog=-1
logger_syslog_level=2
logger_stdout=-1
logger_stdout_level=2
debug=0
dump_file=/tmp/hostapd.dump
ctrl_interface=/var/run/hostapd
ctrl_interface_group=0
ssid=Noir
max_num_sta=255
macaddr_acl=0
auth_algs=3
wme_enabled=1
wme_ac_bk_cwmin=4
wme_ac_bk_cwmax=10
wme_ac_bk_aifs=7
wme_ac_bk_txop_limit=0
wme_ac_bk_acm=0
wme_ac_be_aifs=3
wme_ac_be_cwmin=4
wme_ac_be_cwmax=10
wme_ac_be_txop_limit=0
wme_ac_be_acm=0
wme_ac_vi_aifs=2
wme_ac_vi_cwmin=3
wme_ac_vi_cwmax=4
wme_ac_vi_txop_limit=94
wme_ac_vi_acm=0
wme_ac_vo_aifs=2
wme_ac_vo_cwmin=2
wme_ac_vo_cwmax=3
wme_ac_vo_txop_limit=47
wme_ac_vo_acm=0
eapol_key_index_workaround=1
eap_server=0
own_ip_addr=[REMOVED]
wpa=2
wpa_psk=[REMOVED]
wpa_key_mgmt=WPA-PSK
wpa_pairwise=CCMP
wpa_group_rekey=1800
wpa_gmk_rekey=86400
stakey=1
passive_scan_interval=0
passive_scan_listen=0
passive_scan_mode=0
ap_table_max_size=255
ap_table_expiration_time=3600

Many thanks,
Chris Boot