Hi everyone, I’m troubleshooting a WiFi issue affecting some iPads on a WPA2-PSK network with captive portal. Problem: The iPad shows “incorrect password” when connecting to the SSID. The password is correct (validated with multiple devices). Other devices connect normally. After entering the password, the captive portal should appear, but it never does. What we see on the network side (Cisco WLC): Client associates successfully. RADIUS authentication is successful. Failure occurs during the 4-way handshake: Received EAPOL-key M2 with invalid MIC This causes deauthentication, which the iPad reports as “incorrect password”. From the iPad sysdiagnose (Entity_Join file): Entity_2026-04-15_10_23_39.529_Join Entity_2026-04-15_10_23_39.529_Join.csv Questions: Does anyone know how to interpret: reason status subReason values in Entity_Join logs? Specifically: What does reason = -3925 mean? What does reason = 1 mean? What does subreason = 524288 mean? Any insight into these codes or similar experiences would be really helpful. Thanks!