Mask only working partially

[bobcat]

Heya all,

I have this hash

Code:

WPA*01*44da7fcbc0465ea5a5938f5d9c695253*9aded09afa5f*b4e1eb20d94c*544553545f4150***

For which the password is asdfPWD1

When I run the following hashcat, it finds it OK:

Code:

hashcat -m 22000 pmkid-only -a 3 "asdfPWD1"

However, if I replace the last three capital letters with a ?u?u?u mask, it fails to find it:

Code:

hashcat -m 22000 pmkid-only -a 3 "asdf?u?u?u1"

...

Session..........: hashcat
Status...........: Exhausted
Hash.Name........: WPA-PBKDF2-PMKID+EAPOL
Hash.Target......: pmkid-only
Time.Started.....: Thu Jan 13 15:27:17 2022 (5 secs)
Time.Estimated...: Thu Jan 13 15:27:22 2022 (0 secs)
Guess.Mask.......: asdf?u?u?u1 [8]
Guess.Queue......: 1/1 (100.00%)
Speed.#2.........:    3399 H/s (2.01ms) @ Accel:2 Loops:2 Thr:512 Vec:1
Recovered........: 0/1 (0.00%) Digests
Progress.........: 17576/17576 (100.00%)
Rejected.........: 0/17576 (0.00%)
Restore.Point....: 17576/17576 (100.00%)
Restore.Sub.#2...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidates.#2....: asdfANA1 -> asdfXQJ1

Changing the mask to asdfP?u?u1 works just fine, as well as asd?l?u?uD1. Is there something wrong with my syntax or is it a bug?