Axe reports the following as an issue under aria-valied-attr-value because the #settings element doesn't exist until the button is activated.

<button aria-haspopup="true" aria-controls="settings">
  Settings
</button>

Axe-core has logic that allows this when aria-expanded="false" is on the button, but not without it. I think this exception should be extended to elements with aria-haspopup. Perhaps here it would be appropriate to report it as needs review instead of pass. We don't know whether the control is expanded or not.