Upload ~15 Mb/s to Technicolor XB7 (CGM4331COM) unless PMF is disabled on the client (iwlwifi AX210 and rtw89 RTL8922AE)

[frankth3tank79]

Hi,

I found this bug while setting up my laptop. Would it be possible to take a look at it?

Upload (STA -> AP) throughput is about 15 Mb/s when this laptop associates
with a Comcast/Technicolor XB7 gateway, model CGM4331COM (Broadcom radio,
ISP-managed). Setting PMF to "disable" in NetworkManager on the client raises
it to about 90-100 Mb/s. The same laptop gets about 700 Mb/s upload to a
different AP. Other (non-Linux) clients on the XB7 are not affected.

Hardware / software
  Laptop: HP OmniBook 5 16-cd0xxx, BIOS F.07
  Card 1: Intel AX210, iwlmvm, fw 89.b20dcd1f.0 (ty-a0-gf-a0-89.ucode)
  Card 2: Realtek RTL8922AE (rtw89), the laptop's original card: same symptom
  Kernels: 7.2.11-200.fc44 (Fedora 44), 7.3.0-9-generic (Ubuntu 26.04 live)
  wpa_supplicant 2.11, NetworkManager 1.56.1, linux-firmware 20261019

Link
  5 GHz ch 157, 80 MHz, HE 2x2, signal about -60 dBm
  tx bitrate HE-MCS 5-7 NSS 2 (576-720 Mbit/s), so the PHY rate is fine

Results (iperf3 -P4, STA sending, TCP, to a host behind the AP)
  PMF default (optional), run 1     15.8 Mbit/s
  PMF disabled,           run 1    101   Mbit/s
  PMF default,            run 2     14.0 Mbit/s
  PMF disabled,           run 2     87.1 Mbit/s
  Different AP (phone hotspot, HE80 2x2, PMF default)   706-747 Mbit/s

With PMF at default, the upload looks like this:
  - only ~130 frames/s are handed to the radio (station dump tx packets),
    with ~35% tx retries and 0 tx failed
  - ping to the AP rises from 6 ms idle to 85 ms avg / 331 ms max under load
  - UDP upload tops out at ~2,300 frames/s, one datagram per frame
  - forcing VHT (no HE) gives the same result, so TWT and UL OFDMA are not
    involved
  Download from the AP is also limited (~40-50 Mbit/s).

Relevant AP IEs (from iw scan dump)
  RSN capabilities: 0x000c  (MFPC=0, MFPR=0: the AP does not advertise PMF)
  HT capabilities: Max AMSDU 3839, RX AMPDU 65535, spacing 4 usec
  VHT operation: basic MCS set 0x0000  (demands MCS 0-7 on all 8 streams)
  HE operation: basic HE-MCS NSS set 0xfffc, BSS color disabled
  WMM BE: CW 15-1023, AIFSN 3, TXOP 0
Kernel 6.19.10 logged "required MCSes not supported, disabling HT" with this
AP and fell back to 54 Mbit/s legacy. 7.2/7.3 associate with HE.

So the client advertises MFPC (PMF optional), the AP doesn't, PMF should not
be negotiated, yet upload is ~6x slower than with PMF disabled. My guess is
that the AP mishandles a STA whose RSNE has MFPC set, maybe by treating some
frames (e.g. action frames for BA setup) as protected. A capture can be
provided if useful.

Is this a known XB7 interop issue? Would a quirk make sense, e.g. not
advertising MFPC when the AP's RSNE has MFPC=0?

Thank you,
Frank