The only MAT bug of which I am aware was fixed in earlier 16.x code, but the platforms on which this event detector usually applies are switches. The ISR4K may not work here. My 1941 with a switch EHWIC doesn't even offer the MAT ED. While not as efficient, you could likely achieve some similar results with a timer-based policy that runs "show mac address-table" or the equivalent command.
TAC should have helped you. This is a matter of feature functionality vs. any customized scripting. But I think the bug may be that the ISR4K exposes this ED in the first place.
