Well, when we disabled "DoS Prevention" in Virtual AP profiles, the numbers start to match ;-)
We definetely can observe, now, that the number of associated clients per an access point is not accummulating.
Both commands: #show ap association ap-name <AP_NAME> and #show user location <AP_NAME> show matching numbers.
Our software version: AOS-W 6.1.2.4, Build number:30768
In ArubaOS 6.1 UG, there is definition of how "DoS Prevention" works:
"If enabled, APs ignore deauthentication frames from clients. This prevents a successful
deauthorization attack from being carried out against the AP. This does not affect thirdparty
APs. Default: Disabled"
So, question now: is it the bug in 6.1.x.x ? We wish this feature will be enabled, coz our WIP on our controlles detects a number of
"Block ACK DoS Attacks" and "Power Save DoS Attacks".