Fingerprints matching WITHOUT the passphrase and diverging WITH it is actually good news: it proves the mnemonic is identical on both devices. The entire disagreement is in how the passphrase becomes the salt. So this is findable, and you should find it before you fund anything.
BIP-39 turns your passphrase into the seed like this:
PBKDF2-HMAC-SHA512( password = mnemonic in UTF-8 NFKD,
salt = "mnemonic" + passphrase in UTF-8 NFKD,
2048 iterations, 64-byte output )
Any byte-level difference in that passphrase gives a completely different seed, therefore a different fingerprint. There is no partial match and no near miss.
I wrote a small script that shows exactly which near-identical passphrases diverge, using the PUBLIC BIP-39 test mnemonic — it never asks for your seed and you should not give it one:
https://blossom.primal.net/8399008328ca13a7a90b935b3fa04af1b981462f224b5e6e732a15d3ad1ea328
sha256 8399008328ca13a7a90b935b3fa04af1b981462f224b5e6e732a15d3ad1ea328
Real output, test mnemonic, passphrase "correct horse":
as typed cfc8615d46d6ffeb...
trailing space 33e78746a8411ccd...
leading space 649f158cb7d2a0c6...
double inner space 41fe2673af9b156c...
uppercased 6b15095104adbd8f...
capitalised first 15a01963e851ad30...
Six passphrases that look nearly identical on screen, six completely unrelated seeds.
WHAT IS MOST LIKELY YOURS, given you said you are using BIP-39 words AS the passphrase:
A trailing space. Entering multiple words invites one, and it is invisible.
An autocapitalised first letter, if either device was driven from a phone keyboard.
A double space between two of the words.
NORMALISATION IS PROBABLY NOT YOUR PROBLEM, and I want to rule it out rather than let you chase it: NFKD is a no-op for pure ASCII. My script tests this directly — "correct horse" gives an identical seed with and without normalisation, while "café", "fire" and "①" all diverge. If your passphrase is plain English words, normalisation is not what is biting you. If it has an accent anywhere, it very well might be.
BEFORE YOU FUND THE MULTISIG
A multisig built from a fingerprint you cannot reproduce is a wallet you may not be able to recover, and you will not discover that until you need it. Re-enter the passphrase on both devices deliberately, watching for autocapitalise and trailing spaces, until the fingerprints agree. Then confirm the same receive address on both. Then a small test spend. Then the rest.
Worth flagging separately since you mentioned MK2 firmware 4.x: if that device GENERATED any seed you are still using, check it against the entropy advisory — Mk2/Mk3 are fixed only at 4.2.0, and updating firmware does not repair a seed that already exists. Your fingerprint question is independent of that, but the two are easy to conflate this week.
