From b10101174fd036f872c260842ddf5dd0abde0504 Mon Sep 17 00:00:00 2001
From: Bogdan Nicolae <bogdan.nicolae@gmail.com>
Date: Fri, 26 Jun 2026 01:35:55 -0500
Subject: [PATCH] brcmfmac: pass PMKID to firmware if present

External authentication during WPA3 SAE exchange ignores the PMKID and
passes garbage (whatever is on the stack) downstream. This causes latent
bugs (bogus entries in the firmware's lookup tables) that lead to
connectivity issues. For example, in AP mode, a client that includes a
PMKID in association frames will be rejected. The fix sets the PMKID
either to zeros or the correct value if present, ensuring no bogus
entries are used downstream.

Signed-off-by: Bogdan Nicolae (bogdan.nicolae@acm.org)
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c | 3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c
@@ -221,6 +221,9 @@ brcmf_cyw_external_auth(struct wiphy *wi
 				      IEEE80211_MAX_SSID_LEN);
 	auth_status.ssid_len = cpu_to_le32(params->ssid.ssid_len);
 	memcpy(auth_status.ssid, params->ssid.ssid, params->ssid.ssid_len);
+	memset(auth_status.pmkid, 0, WLAN_PMKID_LEN);
+	if (params->pmkid)
+		memcpy(auth_status.pmkid, params->pmkid, WLAN_PMKID_LEN);
 
 	ret = brcmf_fil_iovar_data_set(ifp, "auth_status", &auth_status,
 				       sizeof(auth_status));
