During a password change the sequence number can increment beyond 4
There is an incorrect header check that rejects reply packets whose sequence is not 2 or 4