The rlm_mschap change to create the Module-Failure-Message attribute creates it on the request chain.  I notice that the original commit on 2010-09-10 (35ee205d4e2dcb4fe5e3) had it in the reply.  Then, a subsequent commit intentionally changed it to the request (401dcce982f9a9972bc7).  Would you be opposed to putting it back on the reply chain?  I ask because of the pending change to save the reply attributes upon failure to survive the final eap round trip.  If it’s not in the reply chain, then it gets lost.  If you’re opposed to this, should the request chain be saved as well (or perhaps just save Module-Failure-Message if it exists)?