IEEE802.11w: iwm/iwlwifi not connecting to AP

From: FreeBSD User <freebsd_at_walstatt-de.de>
Date: Mon, 04 Dec 2023 18:06:24 UTC
Hello,

Access Point is OpenWRT, openwrt-23.05 branch git-23.306.39416-c86c256.

Client are either FreeBSD 13-STABLE or 14-STABLE, last tested on a recent 14-STBLE, running on
Lenovo T560 hardware, WiFi chipset is recognised as Intel Wireless 8260.

iwm(4) is working, but bumpy, see subject and below. iwlwifi(4) on 14-STABLE isn't working as
well as 13.2-STABLE - iwlwifi claims to be up and running with the propper fimware loaded, but
never got any access to any AP recently.

Focussing on iwm(4), when enabling IEEE802.1w (Management Frame Protection) on the OpenWRT
Access Point as "required", no matter what is configured on the client side according to the
global parameter

pmf=0|1|2

and per network setting

ieee80211w=0|1|2

[example: OpenWRT REQUIRES PMF, set to "required" for "AP01"

/etc/wpa_supplicant.conf:

pmf=2

network={
	ssid="AP01"
	auth_alg=OPEN
	key_mgmt=WPA-PSK WPA-EAP
	pairwise=CCMP
	group=CCMP
	ieee80211w=2
	psk=some_weird_number
}
]

In any case, when one side requires PMF, with FBSD 13/14 no connection can be made
successfuly. wpa_cli allways tries to connect, but fails with 

"failed to configure IGTK to the driver"
and connection is rejected : "reason=CONN_FAILED"

No matter what "ieee80211w=" is set to, as long as the AP REQUIRES PMF, a  connection is
rejected, FreeBSD isn't able to connect. Setting the PMF on OpenWRT to "optional" and 
either pmf=0 (and no ieee80211w setting in network definition) or pmf=1|2 in global section of
wpa_supplicant.conf and ieee80211w=0 set in network section, a connection can be made by
FreeBSD.

How can I investigate on FreeBSD's side whether PMF is enabled and used or is not? 

I couldn't find any further doc about whether FreeBSD supports IEEE802.11w or not. 

Thanks in advance,

Oliver

-- 
O. Hartmann