Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] ZigBee: APS frame not decrypted

From: Enrique Giraldo <hgiraldos@xxxxxxxxx>
Date: Fri, 12 Jun 2020 14:01:23 +0200
Sometimes (I could not determine under what conditions) the first encrypted ZB APS packet is not decrypted. After the first one everything is fine. I opened this same capture with Ubiqua and these packets are well decrypted. 
I have a lot of evidence that this happens, so it's easily replicable. I can provide you more evidence if needed.
I've been looking at the code and debugging, but I have no idea what might be happening.
More details and pcap here:  https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16507