Client Vs AP
Several commentards have mentioned that the attack is against the client rather than the AP. Aruba claim in their update that they've implemented a mitigation in their APs against this type of attack.
Also, some APs can act as clients as well as APs (e.g. Mesh or repeater APs)