It is urgent because the same problem exists also with the stable 7.9.1, there are many discussions about it.
It seemed before there was some combination using WPA3 which triggered this.
I reverted back to 7.8 for quite a while on my AX devices to circumvent this, using only WPA2 just to be sure (no wifi for wifey can be … “a challenge” at home 
).
Now running for 5 days already on AX2 and AX3 using 7.10b5 using both WPA2/WPA3, so far no lockouts seen (which I did have a couple of times on 7.9, so I assume also in 7.9.1).
Which indicates there is something else which triggers it ?
@massinia: send supout to support whenever you see it happening. It’s the only way to make them aware and provide them enough info to investigate.
Chicken and egg problem. You need to have the problem to have it investigated but I understand you also want working devices.
Likely not an easy one to catch.
Holvoen,
I gave her instruction how to reset the router in case it freeze again 
Be carefull at version 7.10b5 it happen to me here as well and I had the same combination of WPA2/WPA3 allowed.
What’s new in 7.10beta8 (2023-May-22 18:52):
!) ipv6 - fixed DNS server processing by IPv6/ND services (CVE-2023-32154);
!) route - added BFD (CLI only);
*) bgp - allow to filter BGP sessions by AFI;
*) bgp - changed default VPNv4 import distance to iBGP value (200);
*) bgp - do not check route distinguisher on import;
*) bgp - fixed “as-override” and rename to “output.as-override”;
*) bgp - fixed “remove-private-as” and rename to “output.remove-private.as”;
*) bgp - show address family in advertisements;
*) bgp - show approximate received prefix count by the session;
*) branding - fixed custom logo (introduced in v7.8 );
*) conntrack - added read-only “active-ipv4” and “active-ipv6” fields to “/ip/firewall/connection/tracking” (CLI only);
*) console - fixed “print without-paging” output in some cases;
*) defconf - allow to use device factory preset credentials in Flashfig and Netinstall configuration files;
*) dhcpv4-server - added name for “IPv6-Only Preferred” option (108) in debug logs;
*) doh - less verbose logging;
*) ipsec - added hardware acceleration support for IPQ-5010 (hAP ax lite);
*) ipsec - removed “ec2n185” and “ec2n155” values from proposal configurations;
*) l3hw - added “autorestart” option to L3HW settings;
*) l3hw - added error message and reset “l3-hw-offloading=no” if L3HW driver fails to start;
*) l3hw - fixed offloading of /32 IPv4 and /128 IPv6 routes;
*) l3hw - improved offloading of IPv6 hosts after L3HW driver restart;
*) l3hw - improved performance of partial offloading;
*) l3hw - improved route offloading after gateway change;
*) lora - improved gateway card detection and upgrade logic;
*) lora - updated firmware version for LoRaWAN gateway (for R11e-LoRa8, R11e-LoRa9 cards);
*) lte - fixed APN authentication for R11e-LTE6 modem;
*) lte - improved MBIM modem firmware reported error handling when settings RAT modes;
*) lte - improved modem firmware upgrade stability for MBIM modems;
*) lte - reduced SIM slot switchover time for MBIM modems with UUIC reset support;
*) netwatch - added warning about non-running probe due to “startup-delay” (CLI only);
*) poe - fixed bogous “poe-in-voltage” values when using DC jack for RB5009;
*) qos-hw - renamed VLAN “priority” field to “pcp” to avoid confusion;
*) rose-storage - added support for multiple smb users and smb shares;
*) routerboot - increased “preboot-etherboot” maximum value to 30 seconds (“/system routerboard upgrade” required);
*) scheduler - fixed incorrectly started scheduler during reboot or shutdown;
*) sfp - fixed combo-sfp linking at 1G rate for CRS312 switch;
*) sfp - improved module compatibility with bad EEPROM data for RB4011, RB5009, CCR2xxx, CRS312 and CRS518 devices;
*) sniffer - fixed large .pcap file limit;
*) snmp - added BGP peer table support IPv4 only (1.3.6.1.2.1.15.3.1);
*) tr069 - added 5G SCC “SNR” parameter for modems that report it;
*) vrrp - added warning if “sync-connection-tracking=yes” while the global connection tracking is inactive;
*) vrrp - added warning if the VRRP group is misconfigured;
*) vrrp - added warning if VRRP or its interface does not have an IP address;
*) vrrp - do not start connection synchronization if the global connection tracking is inactive;
*) vrrp - fixed issue where disabled VRRP interface is affecting group;
*) vrrp - fixed VRRP interface state on physical cable disconnection;
*) vrrp - improved system stability on changing “group-authority” or “sync-connection-tracking”;
*) vrrp - renamed “group-master” to “group-authority” to avoid confusion with VRRP master;
*) vrrp - send VRRP announcements only by “group-authority”;
*) wifiwave2 - do not include in radio hardware capability list a parameter irrelevant to end users (introduced in 7.10beta5);
*) wifiwave2 - fixed CAP interface name when using “name-format”;
*) wifiwave2 - fixed connectivity issues wheen access-list is used;
*) wifiwave2 - fixed wireless throughput issues after 802.11r client roaming events on 802.11ac devices;
*) wifiwave2 - improve protections against DoS attacks on WPA3-PSK;
*) wifiwave2 - less verbose logging when WPA3-PSK clients are connecting;
*) wireguard - retry “endpoint-address” DNS query on failed resolve;
BFD! And BGP prefix counters! And BGP SNMP support! It’s Christmas in May!
Thank you very much mikrotik!
Hi,
MT please is in this new beta fixed SUP-116195? . All devices are disconnected and clients say wrong password after reboot all ok.
BFD!!! you heard us, yeah. it works!
*) wireguard - retry “endpoint-address” DNS query on failed resolve;
Great idea! 
Thanks!
@EdPa can you give more details about “wireguard - retry “endpoint-address” DNS query on failed resolve;”
How many times will it retry? Does this solve our problems with dynamic ips on peers where we need to re-toggle tunnel to fix it after IP change?
I was expecting nothing more than the fix for the CVE. Holy crap! And finally all the BFD and BGP complaints will stop!!!
F1/help is missing descriptions for the BFD attributes in CLI
beta 10 : BGP VPN4 have same problems as before 7.9 ; type “copy” routes, and no BGP attributes
SUP-114337 updated as even with the latest fixes in 7.10beta8, all routing ceases to work on my CCR2216 after a few minutes when the L3HW table fills up
[admin@ccr2216] > /interface/ethernet/switch/l3hw-settings/monitor
ipv4-routes-total: 146268
ipv4-routes-hw: 146233
ipv4-routes-cpu: 34
ipv4-shortest-hw-prefix: 0
ipv4-hosts: 137
ipv6-routes-total: 176865
ipv6-routes-hw: 645
ipv6-routes-cpu: 176219
ipv6-shortest-hw-prefix: 48
ipv6-hosts: 133
route-queue-size: 0
fasttrack-ipv4-conns: 0
fasttrack-hw-min-speed: 0
nexthop-cap: 8192
nexthop-usage: 339
https://help.mikrotik.com/docs/display/ROS/L3+Hardware+Offloading#L3HardwareOffloading-CCR2000 was last updated for ROS 7.1 - are these numbers still correct? As i am seeing more routes in the above table, although lots of instability!
Maybe you didn’t actually upgrade, since since beta10 do not have “copy” routes anymore and BGP attributes are there for bgp vpn routes.
As expected (feared), the count is before route filtering, whereas in v6 it was after route filtering.
But still better than nothing!
I like to have them before the filtering!!!
MT why don’t you develop both values (before and after route filtering)??? It could be very nice.
regards
PLEASE Mikrotik staff that reads this thread … reconsider the inline comments on the webfig and also the ‘centering of everything’, as it wastes A LOT of space on the new layout (please see my previous comment showing editing scripts at http://forum.mikrotik.com/t/v7-10beta-testing-is-released/166567/1 ).
While making things prettier is great, making everything worse to use is not. Some of these changes really adds too little while taking A LOT on the usability.
Please reconsider them, PLEASE
It looks like the BFD actually works fine! Hooray!
Next wish-list item: make the “BGP Sessions” tab in winbox auto-refreshing like the “BGP Peers” tab in version 6.
Right now the information displayed w.r.t. active sessions, prefixes, rx/tx messages and uptime is stale unless you press F5 all the time.
The “uptime” field is misleading as it is always counting up from the moment the tab has been opened, even when the session is not up at all…
One wish granted per year, ok ?