Open a case with support as there's several logs that you'll need to check to track down the issue.
For Firmware upgrade:
1) Are the VC entries in monitor or management state? If in monitor only state, is AMP setup allow firmware upgrades in monitor only enabled?
2) How are the firmware images being populated? (from Aruba Activate cloud or manual upload?)
3) How is firmware upgrade being pushed? From individual VC manage page or from bulk modify page or from group firmware enforce?
4) Check /var/log/firmware_enforcer log
5) Check the ap event logs (/var/log/ap/<ap_id_of_VC>/event.log)
For template mismatch:
1) What's the actual template showing? Template is built off of first VC in the group.
2) Perhaps restrict the current template to a version that's not currently being used to create a new template.
3) Check the ap config logs (/var/log/ap/<ap_id_of_VC>/config.log)