WPA3 broadcasting as WEP?

I have a Linksys EA9200 with OpenWRT v25.12.0 installed. I'm trying to set up a WiFi AP with WPA3-SAE.

However, setting encryption to WPA3-SAE using LuCI makes client devices (tested with an Apple laptop and cellphone) believe that it's set to WEP. I haven't experimented with what happens if I actually try to connect over WEP.

WPA2-PSK works properly. WPA2-PSK/WPA3-SAE mixed appears to clients as WPA2-PSK/WEP mixed.

I have two different 802.11ac channels available on my device so if I use one to broadcast an AP and the other to scan for available WiFi networks, OpenWRT itself believes that the WiFi network is WEP.

Config:

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option ssid '<redacted>'
	option encryption 'sae'
	option key '<redacted>'
	option ocv '0'

(I've tried various combinations of OCV and management frame protection, and also tried changing 'sae' to 'sae+ccmp' in the config.)

I found a similar topic for a different device a while back: Asus RT-AC88U: WPA3-SAE APs show up as WEP on client devices on 24.10.0-rc4

Any ideas?

If you set wpa3 alone (note wpa3 prevents downgrade, so you have to remove client profile IF you switch back to WPA2)

WPA3 alone broadcasts as WEP. WPA3/WPA2 mixed broadcasts as WPA2/WEP.

Well, broadcom limitations.