ZD version 10.1 has a new AP firmware image security feature requiring AP image to be "fully signed" or FSI
AP code 9.8 was created before this system was implemented and is considered UI or "unsigned"
You cannot upgrade an AP with UI code directly to FSI code - you must upgrade to an intermediate signed version (ISI)
For ZD ISI code is 9.13 to 10.0
But it is easier to upgrade the AP's to standalone versione 104.x or above - this is ISI code and allows joining either ZD or SCG running ISI or FSI versions
Here is a note explaining the issue:000008727 - AP Image Signing: Unable to upgrade APs running UI (unsigned image) version of firmware ...
I hope this helps