posting this here although it may or may not be related to the nss bits in this build but:
my structure on each of these is basically:
2.4 ssid 0 - hidden, just for my iot
2.4 ssid 1 - visible for 2.4g 'real' clients
5.8 ssid 0 - visible for 5.8g 'real' clients
for what ever reason, i have noticed some bridging issues on the 2.4 hidden ssid.
generally speaking, it works fine, but some arp requests would not answer.
when i moved it to position 2, so like this:
2.4 ssid 0 - visible for 2.4g 'real' clients
2.4 ssid 1 - hidden, just for my iot
this behavior stopped.
i was able to replicate this multiple times, multiple reboots on multiple clients.
what do i mean by bridging issues? well... the devices in question would be able to route to the outside world np. eg: they had wan access. but when i tried to ping / connect / etc to them using my lan (so lan to lan), the arp requests would not get forwarded to the requesting client. so the device attempting to connect to the device on the hidden ssid had no clue how to get to the device let alone for traffic to flow. here is a better example of when it was an issue:
client 1 -> wire -> 301w -> 2.4 hidden ssid -> client 2
when client 1 sent the who has arp requersts before actually trying to flow traffic, client 2 would answer, but the 301w would not pass the arp response back to client 1.
this also happened in the following situation:
client 1 -> 5.8 visible ssid -> 301w -> 2.4 hidden ssid -> client 2
as previously mentioned, as soon as i moved the hidden ssid the 2nd ssid on the 2.4g band this stopped. all works as expected.
last but not least disabling the hidden flag on the ssid also fixed it, but i want to keep my iot ssid hidden so i opted to use this solution.
a bit of a quirk, just posting this here in case anyone is noticing some bridging issues between the various interfaces on their br-lan bridge.
important note, these devices are in dumb-ap mode. my wan to lan happens 2 floors down where we rarely are. also my iot network is as vanilla as it gets so no 802.11k/v/r etc.