I found it, and it was all my doing.
Some time ago, I built a script that replaced "ping" with "ping.dist -c
3 $1" (and forgot that I had) so I wouldn't have to type -c 3 all the
time. That broke ping for everybody else.
When I looked at the log of one of the static IP fails, I saw wicd
trying to verify the AP association by pinging the firewall with "ping
-q -c 1 -w 3 192.168.3.1" (the LAN hole on the firewall). It didn't
work, of course. But it certainly explains the failures.
The log of a successful DHCP contained this:
2016/07/30 16:09:36 :: not verifying
And that explains why a DHCP config is successful.
Fixing ping made everything all better again -- wicd verifies only on
static wireless configs. There's a question in my mind why anyone would
do that, but I'm sure it seemed like a good idea to the programmer.
Significant embarrassment on my part, but I sure thank all of you,
especially Brian, for a very interesting adventure. I learned much more
than I ever wanted to know about wicd and WiFi...
--
Glenn English