Not looked at it very closely, but one red flag is String MAC.
String objects are no C-strings but snprintf() needs one where a %s is expected.
You can either use (const char*)MAC or MAC.c_str() to “derive” a C-string from a String object.
When directly referencing MAC you are actually handing over the object pointer and snprintf() expects to find the start of the %s string there.
But since this is only the base address of the object’s dynamic data area you will not find the internal string buffer but some other object fields stored before the string buffer.