As wireshark hints, the message digest is always included in the message even if the advertise security key is not configured.

This would not be such a problem if the salt actually used wouldn't be random bits from the memory.

This renders the digest completely useless since it can never be verified.