[Pi 4] Other machines cannot connect to wireless AP when ieee80211w=1

Is this the right place for my bug report?
It might be related to brcmfmac firmware. I am using the firmware from https://github.com/RPi-Distro/firmware-nonfree

Describe the bug
It looks like brcmfmac does not support ieee80211w/MFP in AP mode. Clients are unable to connect to the network because the RSN IE message during handshake is different from the one in the beacon frame.

Disabling ieee80211w fixes the issue.

If I run the same hostapd.conf on my laptop (iwlwifi/iwlmvm), my phone connects to it just fine.

To reproduce
hostapd.conf:

ctrl_interface=/var/run/hostapd
ctrl_interface_group=wheel

driver=nl80211

macaddr_acl=0
wmm_enabled=1
country_code=BG
ignore_broadcast_ssid=0
hw_mode=g
ieee80211n=1
ieee80211w=1
ieee80211d=1
channel=6

interface=wlan0

ssid=REDACTED
wpa=2
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP
wpa_passphrase=REDACTED

Expected behaviour
Clients can connect to the network.

Actual behaviour
Clients cannot connect to the network.

System
Device: Raspberry Pi 4 Model B Rev 1.2
Kernel: rpi-5.6.y from 5377449ffb6ffe9ebfee939d52b2611130fbb836
Firwmare version: May 11 2020 18:59:41, 21bfdeee3a6ea823e2113b983390acd1eec8edfb (clean) (release) (start)
OS: Fedora 32 aarch64
hostapd: hostapd-2.9-3.fc32.aarch64

Logs
No errors appear on the Pi.

Here is what happens on my laptop when it tries to connect:

wpa_supplicant: wlan: SME: Trying to authenticate with dc:a6:32:87:2a:8d (SSID='REDACTED' freq=2437 MHz)
kernel: wlan: authenticate with dc:a6:32:87:2a:8d
kernel: wlan: send auth to dc:a6:32:87:2a:8d (try 1/3)
wpa_supplicant: wlan: Trying to associate with dc:a6:32:87:2a:8d (SSID='REDACTED' freq=2437 MHz)
kernel: wlan: authenticated
kernel: wlan: associate with dc:a6:32:87:2a:8d (try 1/3)
kernel: wlan: RX AssocResp from dc:a6:32:87:2a:8d (capab=0x411 status=0 aid=1)
wpa_supplicant: wlan: Associated with dc:a6:32:87:2a:8d
wpa_supplicant: wlan: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
kernel: wlan: associated
wpa_supplicant: wlan: WPA: IE in 3/4 msg does not match with IE in Beacon/ProbeResp (src=dc:a6:32:87:2a:8d)
wpa_supplicant: WPA: RSN IE in Beacon/ProbeResp - hexdump(len=22): 30 14 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 00 0f ac 02 0c 00
wpa_supplicant: WPA: RSN IE in 3/4 msg - hexdump(len=26): 30 18 01 00 00 0f ac 04 01 00 00 0f ac 04 02 00 00 0f ac 02 00 0f ac 08 0c 00
kernel: wlan: deauthenticating from dc:a6:32:87:2a:8d by local choice (Reason: 17=IE_DIFFERENT)
wpa_supplicant: wlan: CTRL-EVENT-DISCONNECTED bssid=dc:a6:32:87:2a:8d reason=17 locally_generated=1

Start with the brcmfmac AP path and the supplied hostapd.conf, then compare the RSN IE in the beacon or probe response with the IE in the 3/4 handshake message. Reproduce with ieee80211w=1 on the Raspberry Pi 4 and confirm that clients can connect without the IE mismatch or deauthentication.