wpa_supplicant: Madwifi WPA2 with Radius auth won't reconnect

[David Ehrmann]

I'm using a January madwifi build, and wpa_supplicant v0.6.2.

I'm running wpa_supplicant like this: wpa_supplicant -t -d -c 
/etc/wpa_supplicant.conf -i ath0 -D wext

My config looks like this:

ctrl_interface=/var/run/wpa_supplicant

eapol_version=2
ap_scan=1

network={
        ssid="MyAP"
        scan_ssid=1
        bssid=00:0d:97:04:85:aa
        key_mgmt=WPA-EAP
#        proto=WPA2
        pairwise=CCMP TKIP
        #TKIP
        group=CCMP TKIP
        eap=PEAP TLS
        #eap=TLS
        identity="..."
        password="..."
        phase2="auth=MSCHAPV2"
        priority=10
}

My connection usually works fine for a while (hours).

A new, invalid AP is sent by the driver, and wpa_supplicant blacklists 
the real one.  Very shortly later, the driver sends a new AP, this time 
the correct one.
 
wpa_supplicant tries to re-authenticate (maybe a few times)
 
10 sec after negotiating a WPA key, wpa_supplicant gets this: "Wireless 
event: new AP: 00:00:00:00:00:00"
 
This is 16s after the problems started.

This process repeats a few times, until I finally see this:

BSSID 00:0d:97:04:85:aa blacklist count incremented to 2
 
When I did iwconfig, the speed was a lot higher than it normally is, and 
the txpower was reset to the driver's default.
 
When this problem happens, I can't usually reassociate without 
rebooting.  If it was link quality, I'd expect to be able to reconnect 
after breaking from wpa_supplicant, then starting it again.  I wouldn't 
expect waiting 1 minute because of a reboot to help.  When I do reboot, 
wpa_supplicant connects quickly.

Here's the wpa_supplicant log (with timestamp annotations at the top, so 
you can skip through the stuff leading up to it)

http://pastebin.com/m1ce18712

Thanks in advance.