M1 MacBook Pro can't join Linux hotspot when other devices can

Question

On a laptop running Linux Mint, I can run these commands to stand up a WiFi hotspot:

nmcli con add type wifi ifname [interface name] con-name test_ssid autoconnect yes ssid test_ssid
nmcli con modify test_ssid 802-11-wireless.mode ap ipv4.method shared
nmcli con modify test_ssid wifi-sec.key-mgmt wpa-psk
nmcli con modify test_ssid 802-11-wireless-security.pairwise ccmp
nmcli con modify test_ssid 802-11-wireless-security.group ccmp
nmcli con modify test_ssid wifi-sec.psk [password]

The resulting test_ssid can be joined by iPhone, Windows, and even Intel MacBook Pros running macOS 12.6. But it can't be joined by an M1 MacBook Pro running macOS 13.0. Does anyone know why, or if there's a way to get M1 Macs to join Linux WiFi hotspots, or if there's a way to get debug output from the connection attempt? When I try to join the network from the M1 MBP, it says The Wi-Fi network "test_ssid" requires a WPA3 Personal., which is odd.

Additional context from my SuperUser post:

I've checked the logs at /var/log/wifi.log which weren't helpful, nor were the diagnostics as far as I could tell, but I did find more useful logs by running log stream --predicate '(processImagePath contains "airportd")'. Viewing that output while attempting to join the network, I see messages like Failed to associate to Wi-Fi network test_ssid on interface en0, returned error code -3906. Looking at CoreWLANTypes.h, I see that -3906 is kCWUnspecifiedFailureErr.

In the comments of that same header file, kCWUnspecifiedFailureErr is described as Access point did not specify a reason for authentication/association failure. So I figured I'd check the access point end of things. If I tail -f /var/log/syslog on the Linux machine/hotspot, I can see when other clients associate/disassociate, but nothing happens at all when the M1 MBP tries to join.

Answer 1

Edit: the solution, in this particular case, is to add a line like the following.

nmcli con modify test_ssid wifi-sec.pmf disable

This will disable SAE and force the use of WPA2 Personal/SHA-256/AES. It would be preferable to get WPA3/SAE working, but I have not been able to do so with my Qualcomm Atheros QCA6174. I suspect this card performs the authentication itself rather than delegate it to the OS (Linux in this case), and because it's from 2015 or so, is too old to do SAE.

Original answer:

The problem was wpasupplicant 2.10 on Linux. Hotspots created with wpasupplicant 2.9 are able to be joined by the M1 MacBook Pro. When making a network with these commands

nmcli con add type wifi ifname wlp2s0 con-name test_ssid autoconnect yes ssid test_ssid
nmcli con modify test_ssid 802-11-wireless.mode ap ipv4.method shared
nmcli con modify test_ssid wifi-sec.key-mgmt wpa-psk
nmcli con modify test_ssid 802-11-wireless-security.pairwise ccmp
nmcli con modify test_ssid 802-11-wireless-security.group ccmp
nmcli con modify test_ssid 802-11-wireless-security.proto rsn
nmcli con modify test_ssid wifi-sec.psk 12345678
nmcli con up test_ssid

on wpasupplicant 2.10, and scanning for that network from an M1 MacBook Pro with /System/Library/PrivateFramework/Apple80211.framework/Versions/Current/Resources/airport -s, the network shows RSN(PSK,PSK-SHA256,SAE/AES/AES) in the Security column. On wpasupplicant 2.9, it shows RSN(PSK,PSK-SHA256/AES/AES).