The singleton subscriber security cache was overwritten on each new subscribe, breaking PMKID match for all but the most recent service. Move security state to own_svc, matched cred index to peer_svc.