hAP ax lite LTE6 – WiFi AP accepts no clients (associate then deauth loop) on 7.24rc3

**Board:** hAP ax lite LTE6 (L41G-2axD&FG621-EA), IPQ5000
**RouterOS:** 7.24rc3 (testing), build-time 2026-07-28
**wifi-qcom package:** 7.24rc3
**RouterBOOT:** 7.24rc3

Symptom

The radio serves no client as an AP. Clients see the SSID, associate at L2, then the link drops within ~6 seconds and the client retries indefinitely.

Router log (`/log print where topics~"wireless"`):

```
wireless,debug BE:76:C6:35:63:86@wifi1(_mikronet) associated, signal strength -46
wireless,debug BE:76:C6:35:63:86@wifi1(_mikronet) disassociated, connection lost, signal strength -45
wireless,debug BE:76:C6:35:63:86@wifi1(_mikronet) associated, signal strength -46
wireless,debug BE:76:C6:35:63:86@wifi1(_mikronet) disassociated, connection lost, signal strength -44
```

`registered-peers` briefly hits 1, `authorized-peers` stays 0.

Current config (tried, all produce the same result)

```
/interface wifi
set [ find default-name=wifi1 ] configuration.ssid=_mikronet .mode=ap \
security=mikronet-security \
security.authentication-types=wpa2-psk .management-protection=disabled \
.ft=no .ft-over-ds=no channel.band=2ghz-ax width=20/40mhz

/interface wifi security
add authentication-types=wpa2-psk management-protection=disabled \
ft=no ft-over-ds=no name=mikronet-security passphrase=***
```

What I verified / tried:

  • Passphrase is byte-identical between router and client (checked via sha256), and `passphrase=***` set
  • Security profile enabled (`disabled=no`), WPA2-PSK only, PMF **disabled**, FT **disabled**
  • Native `2ghz-ax` and forced `2ghz-n`, 20 MHz, channel 6 (2437) — no change
  • Fresh radio restart (disable/enable) — no change
  • Clean-upgrade / factory-reset state did not help

The decisive control test

Even with **no security at all** (removed the security binding → open AP), a client **still cannot join**:

macOS client `networksetup -setairportnetwork en0 "_mikronet" ""`
→ `Failed to join network _mikronet. Error: -3925`

An open AP has no 4-way handshake to fail, so this isolates the defect to the **802.11 association path in the wifi-qcom driver**, not the PSK/PMF/FT/cipher negotiation.

Related

The same unit also fails to connect as a **station** (client) to any AP — `connect → deauth reason code 3` loop against both a Linksys mesh and an iPhone hotspot, tested on 7.23.2 and 7.24rc3. I had assumed I hit a station-mode-only regression, but the AP-side association failure on the same radio suggests the wifi-qcom association handling is broadly broken here.

Questions for the forum

  1. Anyone else see **AP-side association failures** on hAP ax lite LTE6 (IPQ5000) on 7.24rc3 / 7.23.x?
  2. Is this a known firmware/driver bug in wifi-qcom on this board, or is there a config/setting combination I have not tried?
  3. I tried to downgrade to stable 7.23.3 to test; RouterOS refuses (`omitting package system-7.23.3: newer package system-7.24rc3 is already installed`). What is the supported downgrade path (Netinstall?) and does anyone have a known-good RouterOS version for the **AP path** on this unit?

Environment (for completeness)

  • LTE Cat 6 modem (FG621-EA), wired WAN via ether1, internal WiFi only used as AP
  • Same WiFi brand was previously functional (SSID served clients) before a factory reset + reconfig; failure reproduced on both 7.23.2 and 7.24rc3 after reconfig
  • Happy to provide torch captures / `wifi debug` output if useful

Failing the same way on 7.23.2 and 7.24rc3, right after a factory reset, points away from an rc regression and towards something the reset changed. Worth checking if configuration.country survived it, an unset country can end in odd regulatory and association behaviour, and comparing what /interface wifi radio print reports as allowed channels against what you configured.

On question 3: /system package downgrade is the supported way back. Upload the 7.23.3 npk files to Files (routeros plus the matching wifi-qcom one) and run it, the router reboots into the older version. The "omitting package" message only shows up with a regular install, that path never goes backwards. Netinstall is the fallback if that refuses too.

No promises the country thing finds it, station mode failing on the same radio does not sound great. If it still deauth-loops on a clean 7.23.3 with minimal config, post the result here, at that point a supout.rif to support@mikrotik.com is the real next stop.

Then go into System -> Packages and hit "downgrade". Then continue with reboot (when uploaded packages will get picked up for installation).

Mind that with manual package upload, ROS won't resolve dependencies, upgrade/downgrade will fail if any of installed packages is missing from uploaded set of files. And any "surplus" packages will get installed even if it wasn't previously.