mt7925e: TDLS peer-key install fails ("key addition failed"/"Failed to set TPK"), wedges data path

Summary

On an MT7925 (Wi-Fi 7) using mt7925e, every attempt to set up a TDLS direct link with
a same-AP peer fails at the key-installation step:

wpa_supplicant: TDLS: Creating peer entry for f2:73:80:52:ea:ba
wpa_supplicant: TDLS: Dialog Token in TPK M1 9
wpa_supplicant: nl80211: kernel reports: key addition failed
wpa_supplicant: TDLS: Failed to set TPK to the driver

The kernel rejects the NL80211_CMD_NEW_KEY for the TDLS Peer Key (TPK). Beyond the failed
TDLS link, this wedges the station's data path: the interface stays associated
(carrier=1, good signal, tx failed: 0, beacon loss: 0) but can no longer reach the
default gateway or the internet for a period, recovering on its own or after an interface
bounce (ip link set wlan down/up). Other clients on the same AP are unaffected.

Environment

• NIC: MediaTek MT7925 (RZ717) Wi-Fi 7 160MHz, PCI [14c3:0717]
• Driver: mt7925e (in-tree mt76)
• Kernel: 7.0.0-27-generic (Ubuntu 26.04 LTS) x86_64
• Firmware: WIFI_RAM_CODE_MT7925_1_1.bin / WIFI_MT7925_PATCH_MCU_1_1_hdr.bin (build 20260106)
• ASIC rev 79250000, HW/SW 0x8a108a10
• wpa_supplicant v2.11

Trigger

TDLS is attempted when a same-AP peer exchanges sustained traffic with this station (here, a Tailscale/WireGuard direct path from a phone). Any same-AP peer-to-peer flow should reproduce it.

Notable

The driver logs NOTHING at failure time (no mt7925e/mt76 dmesg); the only signal is the nl80211 NEW_KEY rejection via wpa_supplicant. Happy to capture an mt76 dynamic-debug trace and test patches on request.

Workaround

Disable TDLS on the station, or stop same-AP direct flows (force the VPN to relay). ip link down/up recovers a wedged link.

Start at the mt7925e TDLS handling and the NL80211_CMD_NEW_KEY path for the TDLS Peer Key, then reproduce the failure with a same-AP peer. Capture the mt76 dynamic-debug trace as suggested and compare the rejected TPK installation with the resulting data-path wedge. Done means TDLS key installation succeeds without the kernel rejection and the station retains gateway connectivity.