I have updated the nrf sniffer, wireshark, and nrf connect today (December 13th, 2023). The sniffer is running on the nrf52840 dongle. The sniff works fine with devices that pair if no passkey is involved.
However, if a passkey is needed (in this case it is static so I can enter it in the interface 'Legacy Passkey' field ahead of time. It is VERY annoying that the entry clears when one restarts the capture costing hundreds of extra packets to be captured.
Everything works fine until the slave sends the following to the master LL_START_ENQ_REQ.
After that, all I get is the bad mic error and that the encrypted packet is decrypted incorrectly. All the playing around with positionings changes nothing. The main difference is how long it takes me to enter the passkey on the Android.
The connection between the device and the Android works fine.