wpa_supplicant_s1g Segmentation Fault during Mesh Initialization on Kernel 6.6.109 [OpenWRT]

Software Linux
1

**Summary
**
I am using the morsemicro mm8108 via the Gateworks GW16167 900 MHz radio and am receiving a seg fault error when I try to run my wpa_supplicant_s1g startup command which (I suspect) may be related to the radio insisting on scannig 5GHz chanels.

Environment details

Hardware: Gateworks Venice GW7100

Radio: Morse Micro MM8108 (USB 2.0)

OS: OpenWrt 24.10 (Kernel 6.6.109)

Driver/Tools: morse_usb v1.16.4-gateworks (github link - branch=v1.16.4-gateworks)

Supplicant: wpa_supplicant_s1g v2.12-morse_micro-1.16.4

Problem details
I have successfully disabled UCI radio control and have confirmed that morse_cli is functioning. I then attempt to setup my mesh network (config below) using this command.
/usr/sbin/wpa_supplicant_s1g -i mesh0 -c /etc/wpa_supplicant_halow_mesh.conf -dd

It runs for a while and then I am presented with a segmentation fault immediately following

SAE: Derive PT - group 21

Which might lead you to believe that it’s related to the SAE negotiation, but even with a barebones .conf file (key_mgmt=NONE), I still see a segmentation fault error after wlan0: Setup a new network.I also noticed that the logs for the wpa_supplicant_s1g run show the radio attempting to scan 5GHz frequencies:

nl80211: Scan included (5 GHz mapped) frequencies: 5180 5200 5220 5240 5260 5280 5300 5320 5500 5520 5540 5560 5580 5600 5620 5640 5680 5745 5765 5785 5805 5825 5845 5865 5190 5230 5270 5310 5510 5550 5590 5630 5755 5795 5835 5210 5290 5530 5610 5775 5855 5250 5570 5815

This 5GHz scan is occuring despite my conf file explicitly including the lines:

    s1g_prim_chwidth=0 
    s1g_prim_1mhz_chan_index=0

Here is my .conf file contents:

country=US
ctrl_interface=/var/run/wpa_supplicant_s1g
sae_pwe=1

max_peer_links=10
mesh_fwding=1

network={
ssid=“REDACTED”
key_mgmt=SAE
mode=5

s1g_prim_chwidth=0
s1g_prim_1mhz_chan_index=0

channel=28
op_class=71


mesh_rssi_threshold=-85
sae_password="REDACTED"
pairwise=CCMP
ieee80211w=2
beacon_int=1000
dtim_period=1

}

Final notes

The dmesg logs shows now segfault records.

dmesg -c | grep -i “segfault” returns nothing.