brcmfmac crashes after failed OWE-TM association on HES-GUEST (scan error -12 / commonring failures)

[flowride]

Summary

Connecting to HES-GUEST (OWE/OWE-TM) on Fedora Asahi reliably puts the Broadcom Wi-Fi stack (brcmfmac) into a broken state.
After the failed association, scans and normal Wi-Fi operations degrade or stop until the driver is reloaded.

This looks like a driver/firmware crash path triggered by this network/AP profile.

Environment

• Device: Apple Silicon machine (Asahi platform)
• OS: Fedora Asahi Remix (fc44)
• Kernel: 6.19.13-400.asahi ... +16k
• Network stack:
  • NetworkManager-1.56.0-1.fc44
  • wpa_supplicant-2.11-9.fc44
  • linux-firmware-20260410-1.fc44
  • brcmfmac-firmware-20260410-1.fc44
• Driver modules loaded:
  • brcmfmac_wcc
  • brcmfmac
  • brcmutil
  • cfg80211

Reproduction steps

1. Start from a healthy state where Wi-Fi works on other SSIDs.
2. Attempt to connect to HES-GUEST (seen as OWE-TM).
3. Wait for association/activation failure.
4. Retry scan/connect to any SSID.

Expected behavior

• Either connect successfully, or fail cleanly.
• Wi-Fi scanning and subsequent connections should remain functional.

Actual behavior

• HES-GUEST association times out/fails.
• Then Wi-Fi becomes unstable or unusable:
  • scan results become empty/intermittent
  • connection attempts fail unexpectedly
• Recovery often requires reloading brcmfmac modules.

Key logs observed

NetworkManager

• Activation: (wifi) association took too long
• state change: config -> failed (reason 'ssid-not-found')
• Activation: failed for connection 'HES-GUEST'
• set-hw-addr: failed to set MAC address ... (NME_UNSPEC)
• also seen:
  • ignore error changing the MAC address to globally configured value "stable-ssid", the device does not support it

Kernel / brcmfmac

• brcmf_msgbuf_query_dcmd: Timeout on response for query command
• brcmf_cfg80211_scan: scan error (-5)
• brcmf_cfg80211_scan: scan error (-12)
• brcmf_msgbuf_tx_ioctl: Failed to reserve space in commonring
• repeated failures after the first failed association

Workaround

Reloading Wi-Fi modules restores functionality temporarily:

sudo nmcli radio wifi off
sudo modprobe -r brcmfmac_wcc brcmfmac brcmutil
sudo modprobe brcmfmac
nmcli radio wifi on

[bug_wifi.zip](https://github.com/user-attachments/files/27244243/bug_wifi.zip)