Status: Resolved
Observed: 2026-10-12
Affects: TELUS T3200M gateway, any Wi-Fi client
One device drops off the home SSID mid-session and then reports the correct password as “incorrect” on every attempt. All other devices keep working fine.
The gateway's SmartSteering (band steering) disassociated the client from one band via a BSS Transition Management frame (“Disassociation Imminent”), and the wireless daemon kept corrupted auth state for that client. Every subsequent WPA 4-way handshake is dropped with Reason: 2=PREV_AUTH_NOT_VALID or Reason: 15=4WAY_HANDSHAKE_TIMEOUT, which NetworkManager reports as WRONG_KEY: the “incorrect password” prompt. The stored password was correct the whole time.
Already-connected devices are unaffected because they never re-run the handshake. “Other devices work” does not rule this out.
From the affected device (on a hotspot if needed):
nmcli device wifi list # confirm the SSID is broadcasting journalctl -b --no-pager | grep -E "wlo1.*(Reason|deauth|WRONG)"
The signature in logs: WNM: Disassociation Imminent (the AP initiated the disconnect), then PREV_AUTH_NOT_VALID or 4WAY_HANDSHAKE_TIMEOUT followed by WRONG_KEY. The device associates fine but dies during the handshake and never reaches DHCP, so IP-layer fixes are irrelevant. Connecting happily to a phone hotspot while failing the home SSID is itself strong evidence the fault is router-side.
1. **Do not retype the password first.** Check the stored one: ''nmcli --show-secrets connection show <ssid> | grep psk''. Re-entering a mistyped password while the router's auth state is still broken keeps failing after the router is fixed and looks identical.
2. **Power-cycle the gateway**: unplug ~30 seconds, plug back, wait for the SSID to reappear.
3. Reconnect: ''nmcli --ask connection up <ssid>''.
4. If it still fails: check the gateway admin UI (''http://192.168.1.254'') for a paused or blocked device, and confirm wireless security is still WPA2 rather than WPA3/transition or "PMF required".
# force the 2.4 GHz radio (rule out a band with broken auth state) nmcli con mod <ssid> 802-11-wireless.bssid <bssid> # connect as a "new device" (rule out per-MAC blocking) nmcli con mod <ssid> 802-11-wireless.cloned-mac-address random # revert afterwards nmcli con mod <ssid> 802-11-wireless.bssid "" \ 802-11-wireless.cloned-mac-address "" 802-11-wireless-security.pmf 0
Disable SmartSteering on the T3200M to remove the trigger: admin UI > Wireless Setup > SmartSteering > Disable > Apply. Costs: the gateway may split the SSID into -2.4G and -5G variants (rename both back to the same name and passphrase so devices pick their own band), and paired Wi-Fi extenders can be factory-reset by the change.