AP drops STA data frames for ~130-170ms after 4-way handshake

[Devin Wittmayer]

On Thu, 2026-08-27 at 07:44 +0200, Thomas Hilber wrote:
> That suggests the pairwise key becomes usable for RX some time after
> hostapd authorizes the controlled port, rather than atomically with it.

I think that's right, and I don't think SoftMAC is where it splits.
I ran your test on two more access points.

The first had no radio at all, just software. Median 2.8 ms over 91
associations, not one above 100. That is your FullMAC column, produced
by a SoftMAC access point.

The second was real silicon: a newer MediaTek part on its own driver,
but the same family you already reported, so corroboration rather than
a fresh witness.

  35 of 40 associations   5 to 16 ms
   5 of 40                116, 128, 138, 162, 181 ms

Your range, just not every time. About one in eight, where you were
seeing nearly all of them.

What separates the fast case from the slow ones isn't SoftMAC, it's
where decryption happens. In software the key works the instant it is
set. Everywhere else it has to be shipped out to a chip first.

The port opens on schedule. It's the key that is still in transit.

Your Atheros access point will skip hardware encryption if you ask it
to, with the nohwcrypt parameter.

If the gap goes with it, that is your answer for the price of a reload.
The MediaTek one has no such switch.

The reorder buffer is out as well. Anything dropped later, at
decryption or at the port check, has already been through it and moved
the window along, so no hole opens and the timer never starts.

Mine differs from yours in three ways: a MediaTek client instead of
your ESP32, 5 GHz wide instead of 2.4 narrow, and my clock starts at
the client's end of the handshake rather than the access point's.

Thanks for the pair that were the same box, same kernel, same hostapd,
differing only in radio and driver. That is what made this worth
chasing.

Devin