Status=126 is not a failure — it's the AP protecting itself
"Status=126 means the network is working correctly. The dashboard just does not tell you that."
Not because the outcome matters less. But Status=126 in a WPA3 handshake is not a failure. Engineers who see it in a capture and start troubleshooting the wrong thing lose an hour they will not get back.
What Status=126 actually is
WPA3 uses SAE — Simultaneous Authentication of Equals — a Dragonfly key exchange that replaces the WPA2 pre-shared key handshake. The client sends a Commit frame to start the exchange. The AP responds. Both sides derive a shared key without ever transmitting it. The problem is that the Commit frame is computationally expensive to process. A flood of forged Commit frames from different source MACs can exhaust AP CPU before any legitimate client gets through. That is the attack SAE was designed to resist — and the reason the spec includes anti-clogging token protection.
When the AP decides the network is under potential load, it responds to the client's Commit with Status=126. That is not a rejection. It is the AP saying: prove you are a real device before I spend CPU on your handshake. It issues a token. The client includes the token in a new Commit frame. The AP processes it. The exchange completes.
Two SAE rounds instead of one. By design.
What the capture shows
Captured from a Wiz smart bulb. WPA3-SAE, PMF Required, Wi-Fi 7 AP. The sequence:
t=2.3s SAE Commit Seq=1 → AP responds Status=126 (token issued)
t=4.2s SAE Commit Seq=1 with token → AP responds Status=126 (second round)
t=4.5s SAE Confirm → Status=0 → Association complete → AID=1
4.5 seconds from probe to associated. The anti-clogging retry accounts for 1.9 seconds of that.
Your controller dashboard shows one thing: associated. It does not show how many SAE rounds the client needed. It does not show the token exchange. It does not show the 1.9 second cost. The PCAP shows all of it.
The filters
All Authentication frames. Expected: 9 frames. Shows the full SAE exchange including both rounds.
Status=126 frames only. Expected: 4 frames. Two rounds, both directions. This is the anti-clogging token exchange.
Why this matters
If you are seeing slow WPA3 associations and assuming a misconfiguration — check the SAE round count before you change anything. If you are comparing WPA3 association time to WPA2 and wondering why WPA3 is slower — this is likely why. The retry round is not a bug. It is the AP doing exactly what the spec requires.
Status=126 means the network is working correctly. The dashboard just does not tell you that.
wiz_assoc_sae.pcap — 1,001 frames trimmed to the relevant window. Probe through association success. WPA3-SAE with two anti-clogging token rounds visible. Open in Wireshark.
Download wiz_assoc_sae.pcap