[Bug] BE14 (Wi-Fi 7) hardware crash (-95 Not Supported) and memory leak (-23) when enforcing WPA3 SAE H2E & HE80

Environment:

AP Hardware: Banana Pi BPI-R4 with BE14 (MediaTek Wi-Fi 7) module

AP Firmware: OpenWrt 25.12.2 r32802-f505120278 (wpad-openssl installed)

Client Hardware: Netgear A8000 (MediaTek MT7921AU Wi-Fi 6E)

Client OS: Ubuntu 26.04 (Linux Kernel 7.0)

Description:

I am encountering a driver-level crash on the BE14 Wi-Fi 7 module when attempting to downgrade the 6 GHz radio to Wi-Fi 6 (HE80) with strictly enforced Hash-to-Element (H2E) WPA3-SAE cryptography.

The Context:
The native Linux 7.0 kernel (wpa_supplicant) for the MT7921AU client currently fails to parse the BE14's native Wi-Fi 7 (EHT160) beacons on 6 GHz, resulting in an immediate reason 'ssid-not-found' handshake failure on the client side.

The Crash:
To work around the client limitation, I attempted to force the BE14 radio to broadcast in HE80 mode and strictly enforce H2E (sae_pwe=2). Upon applying this configuration, the MediaTek driver rejects the parameters with a -95 (Not Supported) error. OpenWrt/hostapd then loops, causing a -23 (Too many open files in system) memory leak, and the 6 GHz radio (phy0.2) permanently fails to initialize until the router is completely rebooted.

Steps to reproduce:

1.) Install wpad-openssl to ensure full cryptographic support.
2.) Apply the following configuration to the BE14 6 GHz radio (radio2):
uci set wireless.radio2.channel='37'
uci set wireless.radio2.htmode='HE80'
uci set wireless.default_radio2.encryption='sae'
uci set wireless.default_radio2.ieee80211w='2'
uci set wireless.default_radio2.sae_pwe='2'
uci commit wireless
wifi
3.) Attempt to bring up the 6 GHz interface (wifi up radio2)

Client side logs:
NetworkManager[5411]: Config: added 'key_mgmt' value 'SAE FT-SAE'
NetworkManager[5411]: device (wlx289401b7a2e4): state change: config -> failed (reason 'ssid-not-found', managed-type: 'full')

Router AP-Side Driver Crash (When forcing BE14 to HE80 + sae_pwe=2):
daemon.notice netifd: radio2 (32118): wifi-scripts: Starting
daemon.notice hostapd: Set new config for phy phy0.2:
daemon.notice netifd: radio2 (32118): command failed: Not supported (-95)
daemon.notice hostapd: Set new config for phy phy0.2: /var/run/hostapd-phy0.2.conf
daemon.notice hostapd: Restart interface for phy phy0.2
daemon.err hostapd: Failed to create interface phy0.2-ap0: -23 (Too many open files in system)
daemon.notice hostapd: phy0.2-ap0: interface state UNINITIALIZED->COUNTRY_UPDATE
daemon.notice hostapd: phy0.2-ap0: interface state COUNTRY_UPDATE->ENABLED
daemon.notice hostapd: phy0.2-ap0: AP-ENABLED

(Note: Despite saying AP-ENABLED, iwinfo shows the radio is dead and not broadcasting).

Expected Behavior:

The BE14 module should gracefully accept the downgrade to HE80 and H2E parameters to support legacy Wi-Fi 6E clients. If the hardware physically cannot support this override, the driver should throw a clean error without spiraling into a memory leak/file descriptor exhaustion state that kills the interface.

Start by reproducing the radio2 configuration with channel 37, HE80, ieee80211w=2, and sae_pwe=2, then compare the hostapd, netifd, and client logs shown in the report. Trace the -95 failure followed by the -23 interface-creation error. Done means an unsupported configuration fails cleanly without repeated restarts, file-descriptor exhaustion, or leaving phy0.2 unusable.