Which feature must be enabled on a WLC to ensure that ARP, DHCP, and data traffic can be forwarded to wired clients located behind non-Cisco workgroup bridges?

Layer 3 roaming handles client mobility across IP subnets using tunneling and is unrelated to ARP or DHCP forwarding for wired clients behind a WGB.

The VLAN select feature for WGB clients assigns per-client VLAN mappings but does not resolve the fundamental ARP-proxy and DHCP-forwarding problem for passive wired clients.

Wired clients behind a non-Cisco WGB are passive - they do not originate traffic that lets the WLC learn their MAC-to-IP bindings. Enabling the passive client feature instructs the WLC to proxy ARP requests and forward DHCP traffic on behalf of those silent clients, ensuring they receive IP addressing and that their traffic is properly routed across the wireless infrastructure.

Layer 3 security web authentication is a captive portal authentication mechanism and has no function related to forwarding traffic for devices behind a non-Cisco WGB.