On Sat, Jul 18, 2026 at 01:40:08PM +0200, Stefan Sperling wrote:
> Snapshot test builds on all supported platforms would be welcome.

For people building snapshots, you will need this on top to have
ifconfig work in bsd.rd. Without this change, the kernel will try
to use AKM_SAE exclusively even when ifconfig has not enabled SAE
(as indicated by the SAE_PT flag).
 
M  sys/net80211/ieee80211_node.c  |  5+  7-

1 file changed, 5 insertions(+), 7 deletions(-)

commit - 11dc18464fef078fa6dd96c4c628a769a085ba67
commit + 1bd7c04b653ff31991d7895f22f88f0059646200
blob - 10c16abf261eda7a3d39746533eb090da3c1b4a8
blob + e1dd553fc201fe9a5ee902f7f2eb587940fa8e10
--- sys/net80211/ieee80211_node.c
+++ sys/net80211/ieee80211_node.c
@@ -1748,13 +1748,11 @@ ieee80211_choose_rsnparams(struct ieee80211com *ic)
 	/* filter out unsupported AKMPs */
 	ni->ni_rsnakms &= ic->ic_rsnakms;
 	/* prefer SAE and SHA-256 based AKMPs */
-	if (((ic->ic_flags & IEEE80211_F_PSK) && (ni->ni_rsnakms &
-	    (IEEE80211_AKM_PSK | IEEE80211_AKM_SHA256_PSK))) ||
-	    ((ic->ic_flags & IEEE80211_F_SAE_PT) &&
-	    (ni->ni_rsnakms & IEEE80211_AKM_SAE))) {
-		if (ni->ni_rsnakms & IEEE80211_AKM_SAE)
-			ni->ni_rsnakms = IEEE80211_AKM_SAE;
-		else if (ni->ni_rsnakms & IEEE80211_AKM_SHA256_PSK)
+	if (ieee80211_node_allow_wpa3(ic, ni))
+		ni->ni_rsnakms = IEEE80211_AKM_SAE;
+	else if ((ic->ic_flags & IEEE80211_F_PSK) && (ni->ni_rsnakms &
+	    (IEEE80211_AKM_PSK | IEEE80211_AKM_SHA256_PSK))) {
+		if (ni->ni_rsnakms & IEEE80211_AKM_SHA256_PSK)
 			ni->ni_rsnakms = IEEE80211_AKM_SHA256_PSK;
 		else
 			ni->ni_rsnakms = IEEE80211_AKM_PSK;