We had the debugging session with Aruba TAC today. After changing back to the Instant setup and reenabling HT modes we save high latency and packet loss. Disabling "Client match" somewhat stabilized the situation, but I can still measure somewhere between 1-5% packet loss. There are times when it perfect, but if you measure it long enough you will get packet loss.
I think disabling client match is just a workaround and it relieves the AP of some tasks so it can perform better. (Though the CPU load on the AP was never high, so it's just my theory). The reason I think there is a performance issue with packet processing is that we could see >1000ms latency while client match was enabled.
On my MacBookPro I could see the following entries in the system.log while I was on the Instant setup (we use WPA2 PSK):
Feb 11 14:58:28 Marks-MacBook-Pro kernel[0]: MacAuthEvent en1 Auth result for: 18:64:72:e3:ab:d1 Auth timed out
Feb 11 14:58:30 Marks-MacBook-Pro kernel[0]: MacAuthEvent en1 Auth result for: 18:64:72:e3:98:11 Auth timed out
Feb 11 14:58:31 Marks-MacBook-Pro kernel[0]: MacAuthEvent en1 Auth result for: 18:64:72:e3:98:01 Auth timed out
Feb 11 14:58:31 Marks-MacBook-Pro kernel[0]: MacAuthEvent en1 Auth result for: 18:64:72:e3:9f:81 Auth timed out
Feb 11 14:58:37 Marks-MacBook-Pro kernel[0]: MacAuthEvent en1 Auth result for: 18:64:72:e3:98:11 Auth timed out
...
I never had these on the controller based setup.
So if you have problems with Instant and MacBooks I recommend you to:
1. disable client match
2. open an ticket with Aruba TAC and let them know that others has this problem as well.