Fifth, revised attempt at fixing the issue where PSK-to-VLAN mapping is mishandled during FT events

999-ft-psk-vlan-reassignment-v5.patch

--- a/src/ap/ieee802_11.c
+++ b/src/ap/ieee802_11.c
@@ -38,6 +38,7 @@
 #include "sta_info.h"
 #include "ieee802_1x.h"
 #include "wpa_auth.h"
+#include "wpa_auth_i.h"
 #include "pmksa_cache_auth.h"
 #include "wmm.h"
 #include "ap_list.h"
@@ -466,6 +467,36 @@ static void handle_auth_ft_finish(void *ctx, const u8 *dst,
 	if (status != WLAN_STATUS_SUCCESS)
 		return;

+	/* Reapply per-PSK VLAN mapping for FT roam (dynamic VLAN only) */
+	if (hapd->conf->ssid.dynamic_vlan && sta && sta->wpa_sm) {
+		const u8 *pmk;
+		int pmk_len;
+		struct hostapd_wpa_psk *psk;
+
+		pmk = wpa_auth_get_pmk(sta->wpa_sm, &pmk_len);
+		if (pmk && pmk_len == PMK_LEN) {
+			for (psk = hapd->conf->ssid.wpa_psk; psk; psk = psk->next) {
+				if (os_memcmp(pmk, psk->psk, PMK_LEN) == 0) {
+					if (psk->vlan_id && psk->vlan_id != sta->vlan_id) {
+						struct vlan_description vlan_desc = { .notempty = 1, .untagged =
+						psk->vlan_id };
+
+						wpa_printf(MSG_INFO,
+							   "FT: PSK VLAN reassignment " MACSTR " %d->%d",
+							   MAC2STR(sta->addr), sta->vlan_id, psk->vlan_id);
+
+						if (ap_sta_set_vlan(hapd, sta, &vlan_desc) < 0) {
+							wpa_printf(MSG_INFO,
+								   "FT: PSK VLAN reassignment failed for " MACSTR " (%d->%d)",
+								   MAC2STR(sta->addr), sta->vlan_id, psk->vlan_id);
+						}
+					}
+					break;
+				}
+			}
+		}
+	}
+
 	hostapd_logger(hapd, dst, HOSTAPD_MODULE_IEEE80211,
 		       HOSTAPD_LEVEL_DEBUG, "authentication OK (FT)");
 	sta->flags |= WLAN_STA_AUTH;

@regae Looks like you are doing basically the same, but much earlier - inside the original PSK loop. And it looks simpler. I will try it.