The last part of this is a wpasupplicant bug. The ordering of the shutdown scripts is already well-established, and unmounting remote filesystems takes place at S31 (S31umountnfs.sh). wpasupplicant needs to be fixed to run its shutdown script later than this; probably at S35 or S36, which is the point in the runlevel sequence where networking as a whole is shut down in Debian.
The last part of this is a wpasupplicant bug. The ordering of the shutdown scripts is already well-established, and unmounting remote filesystems takes place at S31 (S31umountnfs.sh). wpasupplicant needs to be fixed to run its shutdown script later than this; probably at S35 or S36, which is the point in the runlevel sequence where networking as a whole is shut down in Debian.