ISE NEAT switch won't authenticate on Sup32-based 6500

Question

I have a 3560-CG switch configured as a NEAT supplicant switch. It is working correctly when connected to a 3750G stack running 12.2(55)SE9 but not when connected to a 6500 Sup32-10G running 12.2(33)SXJ8
The authentication is seen in ISE but 802.1X seems to fail and then switches to MAB (not permitted). So there is some issue with the EAP-MD5 authentication stage
Another possible issue is that the switch then triggers a BPDU-Guard error disable state on the authenticating 6500. I assumed the role of "dot1x supplicant controlled transient" is to supress BPDU's until *successful* authentication, not just completion of the stage. 
The authenticator switch reports:
Nov 18 15:29:57.822: CISP-ERROR (Gi4/32): CISP packet on interface Gi4/32 is dropped as  supplicant is not a switch

Answer 1

That's what I thought but the again, from the 6500 config prompt I actually get echo replys(!) from the FWCTX, with capture enabled as:
     access-list CAP permit ip any any
     capture mgmt access-list CAP interface MGMT packet-length 1500 circular-buffer
But it shows blank and no hit counts. Same happens usind RTMonitor in ASDM (6.2.(2f)) some packets that are permited and routed correctly aren't actually noticed. I don't get any logging for the missing/dropped/denied echo replies from the FWCTX to the 6500 MSFC nor for the successful replies from the 6500 to the FWCTX withh ASDM Debugging logging on.