I finally had time to spend debugging this with GTAC, we checked all the 10.41.07 builds and then a developer made me custom builds, rolling in one change at a time. Here's his conclusion:
I found the root cause. The change for wns0020188 caused ATPC to resolve to a TX Power that was just below the threshold that the MU can hear. I loaded back the GA build (10.41.14.0008) and disabled ATPC and set TX Power to 13 and now it works.
So did you have ATPC enabled, and what was the minimum transmit power? I am still going to go back to GTAC with some questions about this, since unless the change is reverted, the bug is still there. Also it doesn't explain why the AP couldn't hear probe requests from the client in the RealCapture. And I wonder if the reason a
factory reset worked is if it changed the AP channel and so increased the TX power.