[jonkpub]

BCM4387 on an M1 Pro MacBook Pro could not connect to the OWE/PMF-required PUBLIXGUEST network on Aurora .20. The driver's OWE AKM case was unreachable through its authentication mask, and firmware OWE offload was not advertised or completed correctly.

This change enables full OWE offload only when the firmware advertises the exact owe capability and supports the firmware supplicant. It selects the OWE authentication path, lets firmware construct the RSNE after PMF configuration, and waits for both association and firmware-handshake completion before authorizing the port. Initial ROAM success follows the same completion check; stale completion state is cleared between connection attempts.

For full OWE, required PMF remains enforced when the userspace RSNE is omitted, and firmware mfp/bip configuration failures are returned. The first commit separately fixes an existing PMKID-list bounds error that could underflow the remaining IE length before reading the group-management cipher.

Validation

• Built all brcm80211 modules against 7.1.12-2-20261017.20-sep-ARCH; the compiler-version warning is expected (kernel: Clang 22.1.8; local build: Clang 23.1.3). Strict checkpatch reports 0 errors, warnings or checks.
• Extracted production event-handling and key-management tests pass for event ordering, initial ROAM, stale state, required PMF, injected firmware-write failures, PMKID bounds and truncated IEs; the key-management tests run under ASan/UBSan. The capability parser also passed 20,007 edge and randomized cases against an independent reference under ASan/UBSan.
• On October 28, the instrumented equivalent of the final hardened source loaded after reboot on BCM4387 and completed OWE association on PUBLIXGUEST. With portal access active, HTTP and HTTPS checks bound to wlan0 each returned 204. Firmware: 20.96.31.0.8.7.148, FWID 01-126f2c4c; capabilities: owe=1, extowe=0, firmware supplicant enabled. The earlier functional build also passed ten controlled disconnect/reconnect cycles.
• The connection log showed three brief disconnect/reconnect events while alternating between two access points; each recovered in approximately 2–3 seconds. The tester reports these as AP-related; their underlying cause was not independently diagnosed. This does not establish seamless firmware roaming: the local module was tested with roamoff=1.

BCM4388, suspend/resume, PSK regression on the final build, firmware roaming and rekey scenarios remain untested. Firmware events do not carry a proven connection-attempt identifier, so correlation of delayed events across overlapping attempts is not established. The upstream PR contains no trial logging, PCI readiness instrumentation, local installer, NetworkManager policy, firmware, calibration, binaries or private diagnostics. The clean source builds successfully; hardware testing used its instrumented functional equivalent.

Related vendor implementations: OWE configuration and OWE support. This is an adapted, capability-gated implementation, not a wholesale vendor cherry-pick.

Refs #215, specifically the BCM4387 report. The original BCM4388 report remains unverified.

Implementation and source review were AI-assisted with Codex; hardware observations are distinguished above from compile and simulated checks.