[ISSUE] WPS/Reaver - No Association + No M1 Sent + Handshake Never Captured

[MoriNo23]

WPS/Reaver Attack - No Association + Handshake Capture Issue

Environment

• Adapter: TP-Link TL-WN8200ND 2.0
• Chipset: Realtek RTL8192EU
• USB ID: 2357:0126
• Driver: rtl8192eu-linux (clnhub fork)
• Kernel: 6.12.74+deb13+1-amd64
• OS: Debian GNU/Linux 13 (trixie)
• Compilation: CONFIG_WIFI_MONITOR=y

Issue

WPS attacks (Reaver/bully) and handshake capture don't work. The adapter can scan networks and injection test passes, but actual attacks fail - no association, no M1 sent, no handshake captured.

Steps to Reproduce

1. Compile driver with CONFIG_WIFI_MONITOR=y
2. Put interface in monitor mode: airmon-ng start wlan0
3. Test injection: aireplay-ng --test wlan0mon → Works ✅ (sends packets, gets responses)
4. Scan networks: airodump-ng wlan0mon → Networks and clients detected ✅
5. Try handshake capture: aireplay-ng --deauth 5 -a [AP_MAC] wlan0mon
6. Then: airodump-ng wlan0mon --bssid [AP_MAC] -w capture
7. Result: No handshake captured ❌

Expected vs Actual

Handshake Capture:

• Deauth frames are sent ✅
• airodump shows "WPA handshake: [MAC]" → ❌ Never captured
• Clients don't actually disconnect

WPS/Reaver:

• Reaver starts: ✅
• wash shows WPS info: ✅
• Association to AP: ❌ Does NOT associate
• Reaver tries to send M1: ❌ Never sends - no activity

Additional Tests

• aireplay-ng -9 wlan0mon → Shows injection working
• wash -i wlan0mon → Detects WPS-enabled networks ✅
• reaver -i wlan0mon -b [AP_MAC] -vv → Does NOT associate, no M1 sent
• Normal WiFi in STA mode: ✅ Works fine

Question

Is this a hardware/firmware limitation of the RTL8192EU chip? The injection test works but real attacks fail. Is there any driver fix or kernel version that resolves this?

Hardware Details

Bus 002 Device 005: ID 2357:0126 TP-Link 802.11n NIC