You are absolutely right!

Wi-Fi client isolation alone is not of much use because it can be bypassed if the attacker poisons the cache of the victim with the attacker’s Ethernet NIC MAC address.

As you have rightly suggested, if the Wi-Fi APs are put on a separate VLAN then the victim’s data cannot reach the attacker’s machine (which will be on a VLAN different from the AP). In that case, the ARP poisoning attack will end up as a denial of service and man in the middle will not be successful.

Client isolation (PSPF) cannot prevent the attack if the attacker adds an ethernet node to redirect traffic to.

If the hackers ethernet NIC is on a different IP subnet, then the ARP poisoning redirect will not result in packets being forwarded to the hackers ethernet NIC as it will be on an unreachable ethernet segment. The attack will become a denial-of-service rather than man-in-the-middle.

Do you agree that the combination of client isolation and IP subnetting could be used to partially address the Hole196 ARP poisoning attack?