[PATCH] Clear pmksa cache for deauth with reason code 2

[Chien Wong]

On Fri, 21 Nov 2025 15:27:28 +0800, Xiaona Yu wrote:
> In WPA3 connection, when receiving deauth with reason code 2,
> wpa_supplicant should clear the PMKSA cache.
>
> but this PMKSA cache is invalid at this time, the AP will
> reject to connect and send a deauth frame with reason code 2

Why? Any reference? The association rejection with status code
53(STATUS_INVALID_PMKID) is well defined behavior for AP notifying
that it does not have the PMK. And this is what hostap/wpa_supplicant
does. See IEEE 802.11 2020, Section 12.6.10.3. But for the mentioned
deauth mechanism, where is it defined?

It sounds like you've encountered a buggy AP that does not properly
implement SAE or PMK Caching.
Maybe it's best to report this issue to the AP vendor for them
to fix, or just keep this workaround in your codebase?

Regards,
Chien Wong