Control Wifi bit rate of BCM43438 in Raspberry PI 3

I’m using a Raspberry Pi 3 as the platform for a project whose
requirements include acting as a WiFi access point as well as connecting
to a wide variety of WiFi routers. Unfortunately, the WiFi connectivity
is very unstable. The most prominent symptom is frequent disassociations
from the router, often accompanied by a failure to reassociate. In the
worst case, the RPi3 disconnects more than once per minute. Pinging the
RPi3 from a machine connected to its software access point results in
wildly varying ping times in addition to significant packet loss.

Some example output from wpa_supplicant:

wlan0: CTRL-EVENT-DISCONNECTED bssid=60:02:92:cd:d9:30 reason=0
locally_generated=1
wlan0: CTRL-EVENT-REGDOM-CHANGE init=CORE type=WORLD
wlan0: CTRL-EVENT-REGDOM-CHANGE init=USER type=COUNTRY alpha2=US
wlan0: Trying to associate with SSID ‘MySSID’
wlan0: CTRL-EVENT-ASSOC-REJECT status_code=16
wlan0: Trying to associate with SSID ‘MySSID’
wlan0: Associated with 60:02:92:cd:d9:30
wlan0: CTRL-EVENT-REGDOM-CHANGE init=COUNTRY_IE type=COUNTRY alpha2=US
wlan0: WPA: Key negotiation completed with 60:02:92:cd:d9:30 [PTK=CCMP
GTK=TKIP]
wlan0: CTRL-EVENT-CONNECTED - Connection to 60:02:92:cd:d9:30 completed
[id=0 id_str=]

I’ve tried several fixes that worked for other people, including
updating the kernel, disabling power management, setting the regulatory
domain, and switching the channel of the router, without any success.
Disabling the software AP doesn’t help either. However, I’ve made a
couple of interesting discoveries.

Firstly, the instability seems to be affected by use of the built-in
Bluetooth, which our project also requires. Running a repeated Bluetooth
inquiry greatly increases the rate of disconnects reported by the RPi’s
wpa_supplicant, and also seems to make it less likely that the
reassociation will succeed.

Secondly, the instability only seems to occur on WiFi routers supporting
802.11n. This is based on the following sample, which admittedly isn’t
very large:

  1. Cisco DPC3939B (n) - unstable
  2. Cisco Linksys E1200 (n) - unstable
  3. Netgear WNDR3400 (n) - unstable in n mode, but stable when limited to
    54 Mbit/s.
  4. Linksys WAP54G v3 (g) - stable

Based on these observations, I’d like to try limiting the BCM43438
chip’s data rate and forcing it to connect as an 802.11g device, but
it’s not clear whether this is possible using the existing drivers.

Details of my installation:
Raspberry Pi 3 Model B with official power supply
Raspbian Jessie from March 2016
Kernel 4.4.6
wpa_supplicant 2.3
brcmfmac 7.45.41.23 (as reported by ethool)
BCM43438 firmware 01-cc44eda9c
BlueZ 5.23

Any recommendations would be much appreciated.