It seems hostap has a bug. This line:
assumes the ssid is null-terminated. Same for the psk parameter. I can't see where this diversion from the WiFi standard is documented, or even discussed anywhere. It seems the user needs to add the null-termination, and at the very least, null octets and double quotes within the strings are not supported. Is that right?