diff --git a/package/madwifi/Makefile b/package/madwifi/Makefile
index 3c72bc7307..ad7f5c9ba3 100644
--- a/package/madwifi/Makefile
+++ b/package/madwifi/Makefile
@@ -10,7 +10,7 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=madwifi
-PKG_REV:=3053
+PKG_REV:=3252
 PKG_VERSION:=r$(PKG_REV)
 PKG_BRANCH:=madwifi-dfs
 PKG_RELEASE:=1
@@ -25,6 +25,8 @@ PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(PKG_BRANCH)-$(PKG_VERSION)
 
 include $(INCLUDE_DIR)/package.mk
 
+# MADWIFI_DEBUG=1
+
 ifeq ($(ARCH),mips)
   HAL_TARGET:=mips-be-elf
 endif
@@ -88,14 +90,20 @@ MADWIFI_AUTOLOAD:= \
 	wlan_xauth \
 
 ifeq ($(findstring AHB,$(BUS)),AHB)
-	MADWIFI_FILES+= $(PKG_BUILD_DIR)/ath/ath_ahb.$(LINUX_KMOD_SUFFIX)
-	MADWIFI_AUTOLOAD+= ath_ahb
+  MADWIFI_FILES+= $(PKG_BUILD_DIR)/ath/ath_ahb.$(LINUX_KMOD_SUFFIX)
+  MADWIFI_AUTOLOAD+= ath_ahb
 endif
 ifeq ($(findstring PCI,$(BUS)),PCI)
-	MADWIFI_FILES+= $(PKG_BUILD_DIR)/ath/ath_pci.$(LINUX_KMOD_SUFFIX)
-	MADWIFI_AUTOLOAD+= ath_pci
+  MADWIFI_FILES+= $(PKG_BUILD_DIR)/ath/ath_pci.$(LINUX_KMOD_SUFFIX)
+  MADWIFI_AUTOLOAD+= ath_pci
 endif
 
+MADWIFI_APPLETS:=80211stats,athchans,athctrl,athkey,athstats,wlanconfig
+ifneq ($(MADWIFI_DEBUG),)
+  MADWIFI_APPLETS:=$(strip $(MADWIFI_APPLETS)),athdebug,80211debug
+endif
+
+
 define KernelPackage/madwifi
   SUBMENU:=Wireless Drivers
   TITLE:=Driver for Atheros wireless chipsets
@@ -119,7 +127,8 @@ MAKE_ARGS:= \
 	KERNELPATH="$(LINUX_DIR)" \
 	LDOPTS="--no-warn-mismatch " \
 	ATH_RATE="ath_rate/$(RATE_CONTROL)" \
-	WARNINGS="" \
+	WARNINGS="-Wno-unused" \
+	$(if $(MADWIFI_DEBUG),,DEBUG="") \
 	DOMULTI=1
 
 MAKE_VARS:= \
@@ -159,7 +168,7 @@ define KernelPackage/madwifi/install
 	$(INSTALL_DIR) $(1)/lib/wifi
 	$(INSTALL_DATA) ./files/lib/wifi/madwifi.sh $(1)/lib/wifi
 	$(INSTALL_DIR) $(1)/usr/sbin
-	$(CP) $(PKG_BUILD_DIR)/tools/{madwifi_multi,80211stats,athchans,athctrl,athkey,athstats,wlanconfig} $(1)/usr/sbin/
+	$(CP) $(PKG_BUILD_DIR)/tools/{madwifi_multi,$(MADWIFI_APPLETS)} $(1)/usr/sbin/
 endef
 
 $(eval $(call KernelPackage,madwifi))
diff --git a/package/madwifi/files/lib/wifi/madwifi.sh b/package/madwifi/files/lib/wifi/madwifi.sh
index ca933a1ddd..6baf482dc5 100755
--- a/package/madwifi/files/lib/wifi/madwifi.sh
+++ b/package/madwifi/files/lib/wifi/madwifi.sh
@@ -74,7 +74,9 @@ enable_atheros() {
 	local device="$1"
 	config_get channel "$device" channel
 	config_get vifs "$device" vifs
-	
+
+	[ auto = "$channel" ] && channel=0
+
 	local first=1
 	for vif in $vifs; do
 		nosbeacon=
@@ -306,7 +308,7 @@ detect_atheros() {
 		cat <<EOF
 config wifi-device  $dev
 	option type     atheros
-	option channel  5
+	option channel  auto
 
 	# REMOVE THIS LINE TO ENABLE WIFI:
 	option disabled 1
diff --git a/package/madwifi/patches/110-minstrel_counters.patch b/package/madwifi/patches/110-minstrel_counters.patch
deleted file mode 100644
index 7e0b46b67a..0000000000
--- a/package/madwifi/patches/110-minstrel_counters.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-Index: trunk/ath_rate/minstrel/minstrel.c
-===================================================================
---- trunk/ath_rate/minstrel/minstrel.c	(revision 3065)
-+++ trunk/ath_rate/minstrel/minstrel.c	(working copy)
-@@ -446,7 +446,6 @@
- 		const struct ath_desc *ds = &bf->bf_desc[0];
- 		int final_rate = 0;
- 		int tries = 0;
--		int ndx = -1;
- 		int mrr;
- 		int final_ndx;
- 		int rate0, tries0, ndx0;
-@@ -485,8 +484,8 @@
- 		mrr = sc->sc_mrretry && !(ic->ic_flags & IEEE80211_F_USEPROT) && ENABLE_MRR;
- 
- 		if (!mrr) {
--			if ((0 <= ndx) && (ndx < sn->num_rates)) {
--				sn->rs_rateattempts[ndx]++; /* only one rate was used */
-+			if ((0 <= final_ndx) && (final_ndx < sn->num_rates)) {
-+				sn->rs_rateattempts[final_ndx] += tries; /* only one rate was used */
- 			}
- 			return;
- 		}
diff --git a/package/madwifi/patches/124-linux24_compat.patch b/package/madwifi/patches/124-linux24_compat.patch
index 59bf7f728d..45e15932a3 100644
--- a/package/madwifi/patches/124-linux24_compat.patch
+++ b/package/madwifi/patches/124-linux24_compat.patch
@@ -1,7 +1,7 @@
-Index: madwifi-dfs-r3053/ath/if_athvar.h
+Index: madwifi-dfs-r3252/ath/if_athvar.h
 ===================================================================
---- madwifi-dfs-r3053.orig/ath/if_athvar.h	2007-12-13 05:25:10.534225778 +0100
-+++ madwifi-dfs-r3053/ath/if_athvar.h	2007-12-13 05:25:12.842357313 +0100
+--- madwifi-dfs-r3252.orig/ath/if_athvar.h	2008-01-25 21:13:50.832747032 +0100
++++ madwifi-dfs-r3252/ath/if_athvar.h	2008-01-25 21:14:09.785827106 +0100
 @@ -128,6 +128,11 @@
  #define	NETDEV_TX_BUSY	1
  #endif
@@ -14,10 +14,10 @@ Index: madwifi-dfs-r3053/ath/if_athvar.h
  #if LINUX_VERSION_CODE < KERNEL_VERSION(2,4,23)
  static inline struct net_device *_alloc_netdev(int sizeof_priv, const char *mask,
  					       void (*setup)(struct net_device *))
-Index: madwifi-dfs-r3053/ath/if_ath_radar.c
+Index: madwifi-dfs-r3252/ath/if_ath_radar.c
 ===================================================================
---- madwifi-dfs-r3053.orig/ath/if_ath_radar.c	2007-12-13 05:25:10.538226007 +0100
-+++ madwifi-dfs-r3053/ath/if_ath_radar.c	2007-12-13 05:25:12.850357768 +0100
+--- madwifi-dfs-r3252.orig/ath/if_ath_radar.c	2008-01-25 21:13:50.840747487 +0100
++++ madwifi-dfs-r3252/ath/if_ath_radar.c	2008-01-25 21:14:09.789827335 +0100
 @@ -92,6 +92,13 @@
  #define nofloat_pct(_value, _pct) \
  	( (_value * (1000 + _pct)) / 1000 )
@@ -32,11 +32,11 @@ Index: madwifi-dfs-r3053/ath/if_ath_radar.c
  struct radar_pattern_specification {
  	/* The name of the rule/specification (i.e. what did we detect) */
  	const char *name;
-Index: madwifi-dfs-r3053/ath/if_ath.c
+Index: madwifi-dfs-r3252/ath/if_ath.c
 ===================================================================
---- madwifi-dfs-r3053.orig/ath/if_ath.c	2007-12-13 05:25:11.582285503 +0100
-+++ madwifi-dfs-r3053/ath/if_ath.c	2007-12-13 05:25:12.854357994 +0100
-@@ -4595,6 +4595,46 @@
+--- madwifi-dfs-r3252.orig/ath/if_ath.c	2008-01-25 21:13:59.245226430 +0100
++++ madwifi-dfs-r3252/ath/if_ath.c	2008-01-25 21:14:09.797827791 +0100
+@@ -4698,6 +4698,46 @@
  #undef USE_SHPREAMBLE
  }
  
@@ -83,33 +83,27 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  /*
   * Generate beacon frame and queue cab data for a VAP.
   */
-Index: madwifi-dfs-r3053/net80211/ieee80211_scan_ap.c
+Index: madwifi-dfs-r3252/net80211/ieee80211_scan_ap.c
 ===================================================================
---- madwifi-dfs-r3053.orig/net80211/ieee80211_scan_ap.c	2007-12-13 05:25:10.554226918 +0100
-+++ madwifi-dfs-r3053/net80211/ieee80211_scan_ap.c	2007-12-13 05:25:12.858358223 +0100
-@@ -46,12 +46,16 @@
+--- madwifi-dfs-r3252.orig/net80211/ieee80211_scan_ap.c	2008-01-25 21:13:50.852748172 +0100
++++ madwifi-dfs-r3252/net80211/ieee80211_scan_ap.c	2008-01-25 21:14:33.343169561 +0100
+@@ -46,7 +46,12 @@
  #include <linux/netdevice.h>
  #include <linux/init.h>
  #include <linux/delay.h>
--#include <linux/sort.h>
--
- #include "if_media.h"
- 
- #include <net80211/ieee80211_var.h>
- 
++
 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,11)
 +#include "sort.c"
 +#else
-+#include <linux/sort.h>
+ #include <linux/sort.h>
 +#endif
-+
- #define	AP_PURGE_SCANS	2		/* age for purging entries (scans) */
- #define RSSI_LPF_LEN	10
- #define	RSSI_EP_MULTIPLIER	(1<<7)	/* pow2 to optimize out * and / */
-Index: madwifi-dfs-r3053/net80211/sort.c
+ 
+ #include "if_media.h"
+ 
+Index: madwifi-dfs-r3252/net80211/sort.c
 ===================================================================
 --- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ madwifi-dfs-r3053/net80211/sort.c	2007-12-13 05:25:12.862358452 +0100
++++ madwifi-dfs-r3252/net80211/sort.c	2008-01-25 21:14:09.801828016 +0100
 @@ -0,0 +1,120 @@
 +/*
 + * A fast, small, non-recursive O(nlog n) sort for the Linux kernel
diff --git a/package/madwifi/patches/200-no_debug.patch b/package/madwifi/patches/200-no_debug.patch
index a54b33d529..18761939a9 100644
--- a/package/madwifi/patches/200-no_debug.patch
+++ b/package/madwifi/patches/200-no_debug.patch
@@ -1,17 +1,16 @@
-Index: madwifi-dfs-r3053/ath/if_ath.c
+Index: madwifi-dfs-r3246/ath/if_ath.c
 ===================================================================
---- madwifi-dfs-r3053.orig/ath/if_ath.c	2007-12-13 05:25:13.122373270 +0100
-+++ madwifi-dfs-r3053/ath/if_ath.c	2007-12-13 05:25:13.342385808 +0100
-@@ -42,7 +42,7 @@
+--- madwifi-dfs-r3246.orig/ath/if_ath.c	2008-01-25 18:17:16.252409313 +0100
++++ madwifi-dfs-r3246/ath/if_ath.c	2008-01-25 18:24:41.981809984 +0100
+@@ -42,7 +42,6 @@
   * This software is derived from work of Atsushi Onoe; his contribution
   * is greatly appreciated.
   */
 -#define	AR_DEBUG
-+#undef	AR_DEBUG
  #include "if_ath_debug.h"
  #include "opt_ah.h"
  
-@@ -516,9 +516,11 @@
+@@ -522,9 +521,11 @@
  	u_int8_t csz;
  
  	sc->devid = devid;
@@ -21,9 +20,9 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  	DPRINTF(sc, ATH_DEBUG_ANY, "%s: devid 0x%x\n", __func__, devid);
 +#endif
  
- 	/*
- 	 * Cache line size is used to size and align various
-@@ -1280,12 +1282,14 @@
+ 	/* Allocate space for dynamically determined maximum VAP count */
+ 	sc->sc_bslot = 
+@@ -1301,12 +1302,14 @@
  		/* If no default VAP debug flags are passed, allow a few to
  		 * transfer down from the driver to new VAPs so we can have load
  		 * time debugging for VAPs too. */
@@ -38,7 +37,7 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  	}
  	ic->ic_debug = (sc->sc_default_ieee80211_debug & IEEE80211_MSG_IC);
  
-@@ -10308,9 +10312,11 @@
+@@ -10524,9 +10527,11 @@
  				/* XXX validate? */
  				sc->sc_ledpin = val;
  				break;
@@ -50,7 +49,7 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  				break;
  			case ATH_TXANTENNA:
  				/*
-@@ -10721,9 +10727,11 @@
+@@ -10946,9 +10951,11 @@
  	}
  
  	/* initialize values */
@@ -62,67 +61,72 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  	sc->sc_txantenna = 0;		/* default to auto-selection */
  	sc->sc_txintrperiod = ATH_TXQ_INTR_PERIOD;
  }
-Index: madwifi-dfs-r3053/ath_rate/amrr/amrr.c
+Index: madwifi-dfs-r3246/ath_rate/amrr/amrr.c
 ===================================================================
---- madwifi-dfs-r3053.orig/ath_rate/amrr/amrr.c	2007-12-13 05:25:10.422219395 +0100
-+++ madwifi-dfs-r3053/ath_rate/amrr/amrr.c	2007-12-13 05:25:13.342385808 +0100
-@@ -70,7 +70,7 @@
+--- madwifi-dfs-r3246.orig/ath_rate/amrr/amrr.c	2008-01-25 18:17:16.260409771 +0100
++++ madwifi-dfs-r3246/ath_rate/amrr/amrr.c	2008-01-25 18:17:18.304526256 +0100
+@@ -70,7 +70,9 @@
  
  #include "amrr.h"
  
--#define	AMRR_DEBUG
-+#undef	AMRR_DEBUG
++#ifdef AR_DEBUG
+ #define	AMRR_DEBUG
++#endif
  #ifdef AMRR_DEBUG
  #define	DPRINTF(sc, _fmt, ...) do {					\
  	if (sc->sc_debug & 0x10)					\
-Index: madwifi-dfs-r3053/ath_rate/minstrel/minstrel.c
+Index: madwifi-dfs-r3246/ath_rate/minstrel/minstrel.c
 ===================================================================
---- madwifi-dfs-r3053.orig/ath_rate/minstrel/minstrel.c	2007-12-13 05:25:12.006309667 +0100
-+++ madwifi-dfs-r3053/ath_rate/minstrel/minstrel.c	2007-12-13 05:25:13.350386263 +0100
-@@ -117,7 +117,7 @@
+--- madwifi-dfs-r3246.orig/ath_rate/minstrel/minstrel.c	2008-01-25 18:17:16.268410227 +0100
++++ madwifi-dfs-r3246/ath_rate/minstrel/minstrel.c	2008-01-25 18:17:18.316526944 +0100
+@@ -117,7 +117,9 @@
  
  #include "minstrel.h"
  
--#define	MINSTREL_DEBUG
-+#undef	MINSTREL_DEBUG
++#ifdef AR_DEBUG
+ #define	MINSTREL_DEBUG
++#endif
  #ifdef MINSTREL_DEBUG
  enum {
  		ATH_DEBUG_RATE		= 0x00000010	/* rate control */
-Index: madwifi-dfs-r3053/ath_rate/onoe/onoe.c
+Index: madwifi-dfs-r3246/ath_rate/onoe/onoe.c
 ===================================================================
---- madwifi-dfs-r3053.orig/ath_rate/onoe/onoe.c	2007-12-13 05:25:10.438220308 +0100
-+++ madwifi-dfs-r3053/ath_rate/onoe/onoe.c	2007-12-13 05:25:13.354386489 +0100
-@@ -66,7 +66,7 @@
+--- madwifi-dfs-r3246.orig/ath_rate/onoe/onoe.c	2008-01-25 18:17:16.276410682 +0100
++++ madwifi-dfs-r3246/ath_rate/onoe/onoe.c	2008-01-25 18:17:18.320527171 +0100
+@@ -66,7 +66,9 @@
  
  #include "onoe.h"
  
--#define	ONOE_DEBUG
-+#undef	ONOE_DEBUG
++#ifdef AR_DEBUG
+ #define	ONOE_DEBUG
++#endif
  #ifdef ONOE_DEBUG
  enum {
  	ATH_DEBUG_RATE	= 0x00000010,	/* rate control */
-Index: madwifi-dfs-r3053/ath_rate/sample/sample.c
+Index: madwifi-dfs-r3246/ath_rate/sample/sample.c
 ===================================================================
---- madwifi-dfs-r3053.orig/ath_rate/sample/sample.c	2007-12-13 05:25:10.446220763 +0100
-+++ madwifi-dfs-r3053/ath_rate/sample/sample.c	2007-12-13 05:25:13.358386718 +0100
-@@ -68,7 +68,7 @@
+--- madwifi-dfs-r3246.orig/ath_rate/sample/sample.c	2008-01-25 18:17:16.284411140 +0100
++++ madwifi-dfs-r3246/ath_rate/sample/sample.c	2008-01-25 18:17:18.324527396 +0100
+@@ -68,7 +68,9 @@
  
  #include "sample.h"
  
 -#define	SAMPLE_DEBUG
-+#undef	SAMPLE_DEBUG
++#ifdef AR_DEBUG
++#define SAMPLE_DEBUG
++#endif
  #ifdef SAMPLE_DEBUG
  enum {
  	ATH_DEBUG_RATE		= 0x00000010,	/* rate control */
-Index: madwifi-dfs-r3053/tools/do_multi.c
+Index: madwifi-dfs-r3246/tools/do_multi.c
 ===================================================================
---- madwifi-dfs-r3053.orig/tools/do_multi.c	2007-12-13 05:25:11.242266126 +0100
-+++ madwifi-dfs-r3053/tools/do_multi.c	2007-12-13 05:25:13.362386947 +0100
+--- madwifi-dfs-r3246.orig/tools/do_multi.c	2008-01-25 18:17:16.292411592 +0100
++++ madwifi-dfs-r3246/tools/do_multi.c	2008-01-25 18:24:59.262794773 +0100
 @@ -9,16 +9,20 @@
  
      progname = basename(argv[0]);
  
-+#if 0
++#ifdef AR_DEBUG
      if(strcmp(progname, "80211debug") == 0)
  	ret = a80211debug_init(argc, argv);
 +#endif
@@ -132,47 +136,71 @@ Index: madwifi-dfs-r3053/tools/do_multi.c
  	ret = athchans_init(argc, argv);
      if(strcmp(progname, "athctrl") == 0)
  	ret =  athctrl_init(argc, argv);
-+#if 0
++#ifdef AR_DEBUG
      if(strcmp(progname, "athdebug") == 0)
  	ret =  athdebug_init(argc, argv);
 +#endif
      if(strcmp(progname, "athkey") == 0)
  	ret =  athkey_init(argc, argv);
      if(strcmp(progname, "athstats") == 0)
-Index: madwifi-dfs-r3053/tools/Makefile
+Index: madwifi-dfs-r3246/tools/Makefile
 ===================================================================
---- madwifi-dfs-r3053.orig/tools/Makefile	2007-12-13 05:25:11.246266355 +0100
-+++ madwifi-dfs-r3053/tools/Makefile	2007-12-13 05:25:13.362386947 +0100
-@@ -48,7 +48,7 @@
+--- madwifi-dfs-r3246.orig/tools/Makefile	2008-01-25 18:17:16.300412050 +0100
++++ madwifi-dfs-r3246/tools/Makefile	2008-01-25 18:17:29.737177767 +0100
+@@ -46,9 +46,10 @@
+ HAL=   $(TOP)/hal
+ endif
  
++DEBUG=-DAR_DEBUG
  
  ALLPROGS=	athstats 80211stats athkey athchans athctrl \
 -	athdebug 80211debug wlanconfig ath_info
-+	wlanconfig ath_info
++	$(if $(DEBUG),80211debug athdebug) wlanconfig ath_info
  
  OBJS=	$(patsubst %,%.o,$(ALLPROGS) do_multi)
  ALL=	${OBJS} madwifi_multi
-@@ -84,7 +84,7 @@
+@@ -57,7 +58,7 @@
+ 
+ INCS=	-I. -I$(HAL) -I$(TOP) -I$(ATH_HAL)
+ CFLAGS=	-g -O2 -Wall
+-ALL_CFLAGS= $(CFLAGS) $(INCS)
++ALL_CFLAGS= $(CFLAGS) $(INCS) $(DEBUG)
+ LDFLAGS=
+ 
+ all:	$(ALL)
+@@ -84,7 +85,7 @@
  	${CC} -c -o do_multi.o -DDOMULTI=1 ${ALL_CFLAGS} do_multi.c
  madwifi_multi: $(OBJS)
  	${CC} -o madwifi_multi ${LDFLAGS} ${OBJS}
 -	for i in athstats 80211stats athkey athchans athctrl athdebug wlanconfig 80211debug; do \
-+	for i in athstats 80211stats athkey athchans athctrl wlanconfig; do \
++	for i in $(ALLPROGS); do \
  	ln -s -f madwifi_multi $$i; \
  	done
  
-Index: madwifi-dfs-r3053/net80211/ieee80211_linux.h
+Index: madwifi-dfs-r3246/net80211/ieee80211_linux.h
 ===================================================================
---- madwifi-dfs-r3053.orig/net80211/ieee80211_linux.h	2007-12-13 05:25:10.470222132 +0100
-+++ madwifi-dfs-r3053/net80211/ieee80211_linux.h	2007-12-13 05:25:13.362386947 +0100
-@@ -29,8 +29,8 @@
+--- madwifi-dfs-r3246.orig/net80211/ieee80211_linux.h	2008-01-25 18:17:16.308412507 +0100
++++ madwifi-dfs-r3246/net80211/ieee80211_linux.h	2008-01-25 18:17:18.324527396 +0100
+@@ -29,8 +29,6 @@
  #ifndef _NET80211_IEEE80211_LINUX_H_
  #define _NET80211_IEEE80211_LINUX_H_
  
 -#define	IEEE80211_DEBUG
 -#define	IEEE80211_DEBUG_REFCNT			/* Node reference count debugging */
-+#undef	IEEE80211_DEBUG
-+#undef	IEEE80211_DEBUG_REFCNT			/* Node reference count debugging */
  /* #define ATH_DEBUG_SPINLOCKS */		/* announce before spinlocking */
  
  #include <linux/wireless.h>
+Index: madwifi-dfs-r3246/Makefile.inc
+===================================================================
+--- madwifi-dfs-r3246.orig/Makefile.inc	2008-01-25 18:17:16.316412961 +0100
++++ madwifi-dfs-r3246/Makefile.inc	2008-01-25 18:17:18.328527625 +0100
+@@ -148,7 +148,8 @@
+ TOOLS=  $(TOP)/tools 
+ 
+ WARNINGS = -Werror
+-COPTS+= $(WARNINGS)
++DEBUG = -DAR_DEBUG -DIEEE80211_DEBUG
++COPTS+= $(WARNINGS) $(DEBUG)
+ INCS=	-include $(TOP)/include/compat.h -I$(TOP)/include
+ 
+ # TARGET defines the target platform architecture. It must match one of
diff --git a/package/madwifi/patches/201-debug_fix.patch b/package/madwifi/patches/201-debug_fix.patch
new file mode 100644
index 0000000000..4af0e70aba
--- /dev/null
+++ b/package/madwifi/patches/201-debug_fix.patch
@@ -0,0 +1,12 @@
+Index: madwifi-dfs-r3246/net80211/ieee80211_debug.h
+===================================================================
+--- madwifi-dfs-r3246.orig/net80211/ieee80211_debug.h	2008-01-25 16:39:52.407138381 +0100
++++ madwifi-dfs-r3246/net80211/ieee80211_debug.h	2008-01-25 16:43:40.104114090 +0100
+@@ -119,6 +119,7 @@
+ #define	ieee80211_msg_assoc(_vap) \
+ 	ieee80211_msg_is_reported(_vap, IEEE80211_MSG_ASSOC)
+ #else /* IEEE80211_DEBUG */
++#define	ieee80211_msg_is_reported(_vap, m) (0)
+ #define	IEEE80211_DPRINTF(_vap, _m, _fmt, ...)
+ #define	IEEE80211_NOTE(_vap, _m, _wh, _fmt, ...)
+ #define	IEEE80211_NOTE_FRAME(_vap, _m, _wh, _fmt, ...)
diff --git a/package/madwifi/patches/300-napi_polling.patch b/package/madwifi/patches/300-napi_polling.patch
index 1cca8f545e..f1799b4219 100644
--- a/package/madwifi/patches/300-napi_polling.patch
+++ b/package/madwifi/patches/300-napi_polling.patch
@@ -1,8 +1,8 @@
-Index: madwifi-dfs-r3053/ath/if_ath.c
+Index: madwifi-dfs-r3246/ath/if_ath.c
 ===================================================================
---- madwifi-dfs-r3053.orig/ath/if_ath.c	2007-12-13 05:25:13.342385808 +0100
-+++ madwifi-dfs-r3053/ath/if_ath.c	2007-12-13 05:25:13.662404044 +0100
-@@ -189,7 +189,7 @@
+--- madwifi-dfs-r3246.orig/ath/if_ath.c	2008-01-25 16:28:31.352327279 +0100
++++ madwifi-dfs-r3246/ath/if_ath.c	2008-01-25 16:30:04.921659489 +0100
+@@ -188,7 +188,7 @@
  	struct sk_buff *, int, int, u_int64_t);
  static void ath_setdefantenna(struct ath_softc *, u_int);
  static struct ath_txq *ath_txq_setup(struct ath_softc *, int, int);
@@ -11,15 +11,15 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  static int ath_hardstart(struct sk_buff *, struct net_device *);
  static int ath_mgtstart(struct ieee80211com *, struct sk_buff *);
  #ifdef ATH_SUPERG_COMP
-@@ -535,7 +535,6 @@
+@@ -545,7 +545,6 @@
  	ATH_TXBUF_LOCK_INIT(sc);
  	ATH_RXBUF_LOCK_INIT(sc);
  
 -	ATH_INIT_TQUEUE(&sc->sc_rxtq,     ath_rx_tasklet,	dev);
- 	ATH_INIT_TQUEUE(&sc->sc_txtq,     ath_tx_tasklet,	dev);
+ 	ATH_INIT_TQUEUE(&sc->sc_txtq,	  ath_tx_tasklet,	dev);
  	ATH_INIT_TQUEUE(&sc->sc_bmisstq,  ath_bmiss_tasklet,	dev);
  	ATH_INIT_TQUEUE(&sc->sc_bstucktq, ath_bstuck_tasklet,	dev);
-@@ -808,6 +807,8 @@
+@@ -822,6 +821,8 @@
  	dev->set_mac_address = ath_set_mac_address;
  	dev->change_mtu = ath_change_mtu;
  	dev->tx_queue_len = ATH_TXBUF - ATH_TXBUF_MGT_RESERVED;
@@ -28,15 +28,15 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  #ifdef USE_HEADERLEN_RESV
  	dev->hard_header_len += sizeof(struct ieee80211_qosframe) +
  				sizeof(struct llc) +
-@@ -2150,6 +2151,7 @@
- 		(status & HAL_INT_RXPHY)   ? " HAL_INT_RXPHY"   : "",
- 		(status & HAL_INT_SWBA)    ? " HAL_INT_SWBA"    : "");
+@@ -2233,6 +2234,7 @@
+ 		(status & HAL_INT_GLOBAL)	? " HAL_INT_GLOBAL"	: ""
+ 		);
  
 +	sc->sc_isr = status;
  	status &= sc->sc_imask;			/* discard unasked for bits */
  	if (status & HAL_INT_FATAL) {
  		sc->sc_stats.ast_hardware++;
-@@ -2201,7 +2203,14 @@
+@@ -2284,7 +2286,14 @@
  		}
  		if (status & (HAL_INT_RX | HAL_INT_RXPHY)) {
  			ath_uapsd_processtriggers(sc);
@@ -52,7 +52,7 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  		}
  		if (status & HAL_INT_TX) {
  #ifdef ATH_SUPERG_DYNTURBO
-@@ -2227,6 +2236,11 @@
+@@ -2310,6 +2319,11 @@
  				}
  			}
  #endif
@@ -64,7 +64,7 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  			ATH_SCHEDULE_TQUEUE(&sc->sc_txtq, &needmark);
  		}
  		if (status & HAL_INT_BMISS) {
-@@ -3904,10 +3918,10 @@
+@@ -4017,10 +4031,10 @@
  	 *
  	 * XXX Using in_softirq is not right since we might
  	 * be called from other soft irq contexts than
@@ -77,7 +77,7 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  	netif_stop_queue(dev);
  }
  
-@@ -3920,7 +3934,7 @@
+@@ -4033,7 +4047,7 @@
  	DPRINTF(sc, ATH_DEBUG_KEYCACHE, "%s:\n", __func__);
  	netif_start_queue(dev);
  	if (!in_softirq())		/* NB: see above */
@@ -86,7 +86,7 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  }
  
  /*
-@@ -6287,13 +6301,12 @@
+@@ -6358,13 +6372,12 @@
  	sc->sc_rxotherant = 0;
  }
  
@@ -102,7 +102,7 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  	struct ath_buf *bf;
  	struct ath_softc *sc = dev->priv;
  	struct ieee80211com *ic = &sc->sc_ic;
-@@ -6305,8 +6318,11 @@
+@@ -6376,8 +6389,11 @@
  	unsigned int len;
  	int type;
  	u_int phyerr;
@@ -114,7 +114,7 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  	do {
  		bf = STAILQ_FIRST(&sc->sc_rxbuf);
  		if (bf == NULL) {		/* XXX ??? can this happen */
-@@ -6330,6 +6346,13 @@
+@@ -6401,6 +6417,13 @@
  			/* NB: never process the self-linked entry at the end */
  			break;
  		}
@@ -128,7 +128,7 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  		skb = bf->bf_skb;
  		if (skb == NULL) {
  			printk("%s: no skbuff (%s)\n", DEV_NAME(dev), __func__);
-@@ -6374,6 +6397,7 @@
+@@ -6448,6 +6471,7 @@
  				sc->sc_stats.ast_rx_phyerr++;
  				phyerr = rs->rs_phyerr & 0x1f;
  				sc->sc_stats.ast_rx_phy[phyerr]++;
@@ -136,7 +136,7 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  			}
  			if (rs->rs_status & HAL_RXERR_DECRYPT) {
  				/*
-@@ -6571,9 +6595,33 @@
+@@ -6658,9 +6682,33 @@
  		STAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
  		ATH_RXBUF_UNLOCK_IRQ(sc);
  	} while (ath_rxbuf_init(sc, bf) == 0);
@@ -170,7 +170,7 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  #undef PA2DESC
  }
  
-@@ -8192,11 +8240,22 @@
+@@ -8308,11 +8356,22 @@
  	struct net_device *dev = (struct net_device *)data;
  	struct ath_softc *sc = dev->priv;
  
@@ -193,7 +193,7 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  	netif_wake_queue(dev);
  
  	if (sc->sc_softled)
-@@ -8213,6 +8272,7 @@
+@@ -8329,6 +8388,7 @@
  	struct net_device *dev = (struct net_device *)data;
  	struct ath_softc *sc = dev->priv;
  
@@ -201,7 +201,7 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  	/*
  	 * Process each active queue.
  	 */
-@@ -8233,6 +8293,16 @@
+@@ -8349,6 +8409,16 @@
  	if (sc->sc_uapsdq && txqactive(sc->sc_ah, sc->sc_uapsdq->axq_qnum))
  		ath_tx_processq(sc, sc->sc_uapsdq);
  
@@ -218,17 +218,14 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  	netif_wake_queue(dev);
  
  	if (sc->sc_softled)
-@@ -8250,6 +8320,7 @@
- 	unsigned int i;
+@@ -8367,10 +8437,21 @@
  
- 	/* Process each active queue. */
+ 	/* Process each active queue. This includes sc_cabq, sc_xrtq and
+ 	 * sc_uapsdq */
 +process_tx_again:
  	for (i = 0; i < HAL_NUM_TX_QUEUES; i++)
  		if (ATH_TXQ_SETUP(sc, i) && txqactive(sc->sc_ah, i))
  			ath_tx_processq(sc, &sc->sc_txq[i]);
-@@ -8258,6 +8329,16 @@
- 		ath_tx_processq(sc, sc->sc_xrtxq);
- #endif
  
 +	ATH_DISABLE_INTR();
 +	if (sc->sc_isr & HAL_INT_TX) {
@@ -243,7 +240,7 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  	netif_wake_queue(dev);
  
  	if (sc->sc_softled)
-@@ -8332,6 +8413,7 @@
+@@ -8445,6 +8526,7 @@
  ath_draintxq(struct ath_softc *sc)
  {
  	struct ath_hal *ah = sc->sc_ah;
@@ -251,7 +248,7 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  	unsigned int i;
  
  	/* XXX return value */
-@@ -10095,9 +10177,9 @@
+@@ -10310,9 +10392,9 @@
  	dev->mtu = mtu;
  	if ((dev->flags & IFF_RUNNING) && !sc->sc_invalid) {
  		/* NB: the rx buffers may need to be reallocated */
@@ -263,10 +260,10 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  	}
  	ATH_UNLOCK(sc);
  
-Index: madwifi-dfs-r3053/ath/if_athvar.h
+Index: madwifi-dfs-r3246/ath/if_athvar.h
 ===================================================================
---- madwifi-dfs-r3053.orig/ath/if_athvar.h	2007-12-13 05:25:12.842357313 +0100
-+++ madwifi-dfs-r3053/ath/if_athvar.h	2007-12-13 05:25:13.666404270 +0100
+--- madwifi-dfs-r3246.orig/ath/if_athvar.h	2008-01-25 16:28:31.304324541 +0100
++++ madwifi-dfs-r3246/ath/if_athvar.h	2008-01-25 16:28:36.740634339 +0100
 @@ -50,6 +50,10 @@
  #include <asm/io.h>
  #include <linux/list.h>
@@ -294,7 +291,7 @@ Index: madwifi-dfs-r3053/ath/if_athvar.h
  	struct ATH_TQ_STRUCT sc_txtq;		/* tx intr tasklet */
  	u_int8_t sc_grppoll_str[GRPPOLL_RATE_STR_LEN];
  	struct ath_descdma sc_bdma;		/* beacon descriptors */
-@@ -853,6 +857,8 @@
+@@ -854,6 +858,8 @@
  #define	ATH_TXBUF_LOCK_CHECK(_sc)
  #endif
  
@@ -303,51 +300,119 @@ Index: madwifi-dfs-r3053/ath/if_athvar.h
  
  #define	ATH_RXBUF_LOCK_INIT(_sc)	spin_lock_init(&(_sc)->sc_rxbuflock)
  #define	ATH_RXBUF_LOCK_DESTROY(_sc)
-Index: madwifi-dfs-r3053/net80211/ieee80211_input.c
+Index: madwifi-dfs-r3246/net80211/ieee80211_input.c
 ===================================================================
---- madwifi-dfs-r3053.orig/net80211/ieee80211_input.c	2007-12-13 05:25:10.374216660 +0100
-+++ madwifi-dfs-r3053/net80211/ieee80211_input.c	2007-12-13 05:25:13.674404726 +0100
-@@ -1178,7 +1178,7 @@
+--- madwifi-dfs-r3246.orig/net80211/ieee80211_input.c	2008-01-25 16:27:28.000000000 +0100
++++ madwifi-dfs-r3246/net80211/ieee80211_input.c	2008-01-25 16:32:53.171247487 +0100
+@@ -1196,7 +1196,7 @@
  			/* attach vlan tag */
  			struct ieee80211_node *ni_tmp = SKB_CB(skb)->ni;
  			if (vlan_hwaccel_receive_skb(skb, vap->iv_vlgrp, ni->ni_vlan) == NET_RX_DROP) {
 -				/* If netif_rx dropped the packet because 
-+				/* If netif_receive_skb dropped the packet because 
++				/* If netif_receive_skb dropped the packet because
  				 * device was too busy */
  				if (ni_tmp != NULL) {
  					/* node reference was leaked */
-@@ -1189,8 +1189,8 @@
+@@ -1207,8 +1207,8 @@
  			skb = NULL; /* SKB is no longer ours */
  		} else {
  			struct ieee80211_node *ni_tmp = SKB_CB(skb)->ni;
 -			if (netif_rx(skb) == NET_RX_DROP) {
 -				/* If netif_rx dropped the packet because 
 +			if (netif_receive_skb(skb) == NET_RX_DROP) {
-+				/* If netif_receive_skb dropped the packet because 
++				/* If netif_receive_skb dropped the packet because
  				 * device was too busy */
  				if (ni_tmp != NULL) {
  					/* node reference was leaked */
-@@ -2299,8 +2299,8 @@
+@@ -2313,8 +2313,8 @@
  		skb1->protocol = __constant_htons(0x0019);  /* ETH_P_80211_RAW */
  
  		ni_tmp = SKB_CB(skb1)->ni;
 -		if (netif_rx(skb1) == NET_RX_DROP) {
 -			/* If netif_rx dropped the packet because 
 +		if (netif_receive_skb(skb1) == NET_RX_DROP) {
-+			/* If netif_receive_skb dropped the packet because 
++			/* If netif_receive_skb dropped the packet because
  			 * device was too busy */
  			if (ni_tmp != NULL) {
  				/* node reference was leaked */
-Index: madwifi-dfs-r3053/net80211/ieee80211_monitor.c
+Index: madwifi-dfs-r3246/net80211/ieee80211_monitor.c
 ===================================================================
---- madwifi-dfs-r3053.orig/net80211/ieee80211_monitor.c	2007-12-13 05:25:10.386217344 +0100
-+++ madwifi-dfs-r3053/net80211/ieee80211_monitor.c	2007-12-13 05:25:13.678404955 +0100
-@@ -577,7 +577,7 @@
- 			skb1->protocol = __constant_htons(0x0019); /* ETH_P_80211_RAW */
+--- madwifi-dfs-r3246.orig/net80211/ieee80211_monitor.c	2008-01-25 16:27:28.000000000 +0100
++++ madwifi-dfs-r3246/net80211/ieee80211_monitor.c	2008-01-25 16:32:05.436527235 +0100
+@@ -586,8 +586,8 @@
+ 			skb1->protocol = 
+ 				__constant_htons(0x0019); /* ETH_P_80211_RAW */
  
- 			ni_tmp = SKB_CB(skb1)->ni;
 -			if (netif_rx(skb1) == NET_RX_DROP) {
+-				/* If netif_rx dropped the packet because 
 +			if (netif_receive_skb(skb1) == NET_RX_DROP) {
- 				/* If netif_rx dropped the packet because 
- 				 * device was too busy */
- 				if (ni_tmp != NULL) {
++				/* If netif_receive_skb dropped the packet because
+ 				 * device was too busy, reclaim the ref. in 
+ 				 * the skb. */
+ 				if (SKB_CB(skb1)->ni != NULL)
+Index: madwifi-dfs-r3246/net80211/ieee80211_skb.c
+===================================================================
+--- madwifi-dfs-r3246.orig/net80211/ieee80211_skb.c	2008-01-25 16:31:47.167486151 +0100
++++ madwifi-dfs-r3246/net80211/ieee80211_skb.c	2008-01-25 16:31:55.695972162 +0100
+@@ -73,7 +73,7 @@
+ #undef dev_queue_xmit
+ #undef kfree_skb
+ #undef kfree_skb_fast
+-#undef netif_rx
++#undef netif_receive_skb
+ #undef pskb_copy
+ #undef skb_clone
+ #undef skb_copy
+@@ -627,8 +627,8 @@
+ 		grp, vlan_tag);
+ }
+ 
+-int netif_rx_debug(struct sk_buff *skb, const char* func, int line) {
+-	return netif_rx(untrack_skb(skb, 0, func, line, __func__, __LINE__));
++int netif_receive_skb_debug(struct sk_buff *skb, const char* func, int line) {
++	return netif_receive_skb(untrack_skb(skb, 0, func, line, __func__, __LINE__));
+ }
+ 
+ struct sk_buff * alloc_skb_debug(unsigned int length, gfp_t gfp_mask,
+@@ -749,7 +749,7 @@
+ }
+ 
+ EXPORT_SYMBOL(vlan_hwaccel_receive_skb_debug);
+-EXPORT_SYMBOL(netif_rx_debug);
++EXPORT_SYMBOL(netif_receive_skb_debug);
+ EXPORT_SYMBOL(alloc_skb_debug);
+ EXPORT_SYMBOL(dev_alloc_skb_debug);
+ EXPORT_SYMBOL(skb_clone_debug);
+Index: madwifi-dfs-r3246/net80211/ieee80211_skb.h
+===================================================================
+--- madwifi-dfs-r3246.orig/net80211/ieee80211_skb.h	2008-01-25 16:31:20.845986170 +0100
++++ madwifi-dfs-r3246/net80211/ieee80211_skb.h	2008-01-25 16:31:36.982905763 +0100
+@@ -116,7 +116,7 @@
+ int  vlan_hwaccel_receive_skb_debug(struct sk_buff *skb, 
+ 				    struct vlan_group *grp, unsigned short vlan_tag, 
+ 				    const char* func, int line);
+-int netif_rx_debug(struct sk_buff *skb, const char* func, int line);
++int netif_receive_skb_debug(struct sk_buff *skb, const char* func, int line);
+ struct sk_buff * alloc_skb_debug(unsigned int length, gfp_t gfp_mask,
+ 				 const char *func, int line);
+ struct sk_buff * dev_alloc_skb_debug(unsigned int length,
+@@ -151,7 +151,7 @@
+ #undef dev_queue_xmit
+ #undef kfree_skb
+ #undef kfree_skb_fast
+-#undef netif_rx
++#undef netif_receive_skb
+ #undef pskb_copy
+ #undef skb_clone
+ #undef skb_copy
+@@ -168,8 +168,8 @@
+ 	skb_copy_expand_debug(_skb, _newheadroom, _newtailroom, _gfp_mask, __func__, __LINE__)
+ #define vlan_hwaccel_receive_skb(_skb, _grp, _tag) \
+ 	vlan_hwaccel_receive_skb_debug(_skb, _grp, _tag, __func__, __LINE__)
+-#define netif_rx(_skb) \
+-	netif_rx_debug(_skb, __func__, __LINE__)
++#define netif_receive_skb(_skb) \
++	netif_receive_skb_debug(_skb, __func__, __LINE__)
+ #define	alloc_skb(_length, _gfp_mask) \
+ 	alloc_skb_debug(_length, _gfp_mask, __func__, __LINE__)
+ #define	dev_alloc_skb(_length) \
diff --git a/package/madwifi/patches/305-pureg_fix.patch b/package/madwifi/patches/305-pureg_fix.patch
index ed3eb20be3..05c54d052b 100644
--- a/package/madwifi/patches/305-pureg_fix.patch
+++ b/package/madwifi/patches/305-pureg_fix.patch
@@ -1,8 +1,8 @@
-Index: madwifi-dfs-r3053/ath/if_ath.c
+Index: madwifi-dfs-r3246/ath/if_ath.c
 ===================================================================
---- madwifi-dfs-r3053.orig/ath/if_ath.c	2007-12-13 05:25:13.662404044 +0100
-+++ madwifi-dfs-r3053/ath/if_ath.c	2007-12-13 05:25:13.934419543 +0100
-@@ -3973,7 +3973,9 @@
+--- madwifi-dfs-r3246.orig/ath/if_ath.c	2008-01-25 16:30:04.921659489 +0100
++++ madwifi-dfs-r3246/ath/if_ath.c	2008-01-25 16:33:11.528293596 +0100
+@@ -4086,7 +4086,9 @@
  		rfilt |= HAL_RX_FILTER_PROM;
  	if (ic->ic_opmode == IEEE80211_M_STA ||
  	    sc->sc_opmode == HAL_M_IBSS ||	/* NB: AHDEMO too */
@@ -13,36 +13,47 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  		rfilt |= HAL_RX_FILTER_BEACON;
  	if (sc->sc_nmonvaps > 0)
  		rfilt |= (HAL_RX_FILTER_CONTROL | HAL_RX_FILTER_BEACON |
-Index: madwifi-dfs-r3053/net80211/ieee80211_input.c
+Index: madwifi-dfs-r3246/net80211/ieee80211_input.c
 ===================================================================
---- madwifi-dfs-r3053.orig/net80211/ieee80211_input.c	2007-12-13 05:25:13.674404726 +0100
-+++ madwifi-dfs-r3053/net80211/ieee80211_input.c	2007-12-13 05:25:13.938419772 +0100
-@@ -329,11 +329,12 @@
+--- madwifi-dfs-r3246.orig/net80211/ieee80211_input.c	2008-01-25 16:32:53.171247487 +0100
++++ madwifi-dfs-r3246/net80211/ieee80211_input.c	2008-01-25 16:35:46.341115878 +0100
+@@ -346,11 +346,12 @@
  				bssid = wh->i_addr3;
  			}
  			/*
 -			 * Validate the bssid.
 +			 * Validate the bssid. Let beacons get through though for 11g protection mode.
  			 */
- #ifdef ATH_SUPERG_XR
- 			if (!IEEE80211_ADDR_EQ(bssid, vap->iv_bss->ni_bssid) &&
+-#ifdef ATH_SUPERG_XR
+ 			if (!IEEE80211_ADDR_EQ(bssid, vap->iv_bssid) &&
 -			    !IEEE80211_ADDR_EQ(bssid, dev->broadcast)) {
 +			    !IEEE80211_ADDR_EQ(bssid, dev->broadcast) &&
 +				(subtype != IEEE80211_FC0_SUBTYPE_BEACON)) {
++#ifdef ATH_SUPERG_XR
  				/*
  				 * allow MGT frames to vap->iv_xrvap.
  				 * this will allow roaming between  XR and normal vaps
-@@ -352,7 +353,8 @@
- 			}
+@@ -366,18 +367,14 @@
+ 					vap->iv_stats.is_rx_wrongbss++;
+ 					goto out;
+ 				}
+-			}
  #else
- 			if (!IEEE80211_ADDR_EQ(bssid, vap->iv_bss->ni_bssid) &&
+-			if (!IEEE80211_ADDR_EQ(bssid, vap->iv_bssid) &&
 -			    !IEEE80211_ADDR_EQ(bssid, dev->broadcast)) {
-+			    !IEEE80211_ADDR_EQ(bssid, dev->broadcast) &&
-+				(subtype != IEEE80211_FC0_SUBTYPE_BEACON)) {
  				/* not interested in */
  				IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  					bssid, NULL, "%s", "not to bss");
-@@ -2971,7 +2973,7 @@
+ 				vap->iv_stats.is_rx_wrongbss++;
+ 				goto out;
+-			}
+-
+ #endif
++			}
+ 			break;
+ 		case IEEE80211_M_WDS:
+ 			if (skb->len < sizeof(struct ieee80211_frame_addr4)) {
+@@ -3023,7 +3020,7 @@
  	u_int8_t *frm, *efrm;
  	u_int8_t *ssid, *rates, *xrates, *suppchan, *wpa, *rsn, *wme, *ath;
  	u_int8_t rate;
@@ -51,7 +62,7 @@ Index: madwifi-dfs-r3053/net80211/ieee80211_input.c
  	u_int8_t qosinfo;
  
  	if (ni_or_null == NULL)
-@@ -2996,11 +2998,15 @@
+@@ -3053,11 +3050,15 @@
  		 *    o station mode when associated (to collect state
  		 *      updates such as 802.11g slot time), or
  		 *    o adhoc mode (to discover neighbors)
@@ -68,7 +79,7 @@ Index: madwifi-dfs-r3053/net80211/ieee80211_input.c
  			vap->iv_stats.is_rx_mgtdiscard++;
  			return;
  		}
-@@ -3083,6 +3089,7 @@
+@@ -3140,6 +3141,7 @@
  					break;
  				}
  				scan.erp = frm[2];
@@ -76,7 +87,7 @@ Index: madwifi-dfs-r3053/net80211/ieee80211_input.c
  				break;
  			case IEEE80211_ELEMID_RSN:
  				scan.rsn = frm;
-@@ -3300,6 +3307,20 @@
+@@ -3357,6 +3359,20 @@
  				ieee80211_bg_scan(vap);
  			return;
  		}
@@ -97,11 +108,11 @@ Index: madwifi-dfs-r3053/net80211/ieee80211_input.c
  		/*
  		 * If scanning, just pass information to the scan module.
  		 */
-Index: madwifi-dfs-r3053/net80211/ieee80211_node.c
+Index: madwifi-dfs-r3246/net80211/ieee80211_node.c
 ===================================================================
---- madwifi-dfs-r3053.orig/net80211/ieee80211_node.c	2007-12-13 05:25:10.314213240 +0100
-+++ madwifi-dfs-r3053/net80211/ieee80211_node.c	2007-12-13 05:25:13.938419772 +0100
-@@ -380,10 +380,16 @@
+--- madwifi-dfs-r3246.orig/net80211/ieee80211_node.c	2008-01-25 16:27:28.000000000 +0100
++++ madwifi-dfs-r3246/net80211/ieee80211_node.c	2008-01-25 16:33:11.540294282 +0100
+@@ -383,10 +383,16 @@
  	/* Update country ie information */
  	ieee80211_build_countryie(ic);
  
@@ -120,11 +131,11 @@ Index: madwifi-dfs-r3053/net80211/ieee80211_node.c
  
  	(void) ieee80211_sta_join1(PASS_NODE(ni));
  }
-Index: madwifi-dfs-r3053/net80211/ieee80211_proto.c
+Index: madwifi-dfs-r3246/net80211/ieee80211_proto.c
 ===================================================================
---- madwifi-dfs-r3053.orig/net80211/ieee80211_proto.c	2007-12-13 05:25:10.322213696 +0100
-+++ madwifi-dfs-r3053/net80211/ieee80211_proto.c	2007-12-13 05:25:13.942420001 +0100
-@@ -584,6 +584,28 @@
+--- madwifi-dfs-r3246.orig/net80211/ieee80211_proto.c	2008-01-25 16:27:28.000000000 +0100
++++ madwifi-dfs-r3246/net80211/ieee80211_proto.c	2008-01-25 16:33:11.544294507 +0100
+@@ -595,6 +595,28 @@
  	{ 4, { 2, 4, 11, 22 } },	/* IEEE80211_MODE_TURBO_G (mixed b/g) */
  };
  
@@ -153,11 +164,11 @@ Index: madwifi-dfs-r3053/net80211/ieee80211_proto.c
  /*
   * Mark the basic rates for the 11g rate table based on the
   * specified mode.  For 11b compatibility we mark only 11b
-Index: madwifi-dfs-r3053/net80211/ieee80211_var.h
+Index: madwifi-dfs-r3246/net80211/ieee80211_var.h
 ===================================================================
---- madwifi-dfs-r3053.orig/net80211/ieee80211_var.h	2007-12-13 05:25:10.330214154 +0100
-+++ madwifi-dfs-r3053/net80211/ieee80211_var.h	2007-12-13 05:25:13.942420001 +0100
-@@ -668,6 +668,7 @@
+--- madwifi-dfs-r3246.orig/net80211/ieee80211_var.h	2008-01-25 16:27:28.000000000 +0100
++++ madwifi-dfs-r3246/net80211/ieee80211_var.h	2008-01-25 16:33:11.548294736 +0100
+@@ -688,6 +688,7 @@
  void ieee80211_build_sc_ie(struct ieee80211com *);
  void ieee80211_dfs_action(struct ieee80211com *);
  void ieee80211_expire_channel_non_occupancy_restrictions(struct ieee80211com *);
diff --git a/package/madwifi/patches/309-micfail_detect.patch b/package/madwifi/patches/309-micfail_detect.patch
index 34f80d659b..c1b6224425 100644
--- a/package/madwifi/patches/309-micfail_detect.patch
+++ b/package/madwifi/patches/309-micfail_detect.patch
@@ -1,8 +1,8 @@
-Index: madwifi-dfs-r3053/ath/if_ath.c
+Index: madwifi-dfs-r3246/ath/if_ath.c
 ===================================================================
---- madwifi-dfs-r3053.orig/ath/if_ath.c	2007-12-13 05:25:13.934419543 +0100
-+++ madwifi-dfs-r3053/ath/if_ath.c	2007-12-13 05:25:14.210435274 +0100
-@@ -6322,6 +6322,7 @@
+--- madwifi-dfs-r3246.orig/ath/if_ath.c	2008-01-25 16:33:11.528293596 +0100
++++ madwifi-dfs-r3246/ath/if_ath.c	2008-01-25 16:36:40.024175098 +0100
+@@ -6393,6 +6393,7 @@
  	u_int phyerr;
  	u_int processed = 0, early_stop = 0;
  	u_int rx_limit = dev->quota;
@@ -10,7 +10,7 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  
  	DPRINTF(sc, ATH_DEBUG_RX_PROC, "%s\n", __func__);
  process_rx_again:
-@@ -6418,24 +6419,8 @@
+@@ -6492,24 +6493,8 @@
  			}
  			if (rs->rs_status & HAL_RXERR_MIC) {
  				sc->sc_stats.ast_rx_badmic++;
@@ -26,7 +26,7 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
 -#if 0
 -/* XXX revalidate MIC, lookup ni to find VAP */
 -					ieee80211_notify_michael_failure(ic,
--					    (struct ieee80211_frame *) skb->data,
+-					    (struct ieee80211_frame *)skb->data,
 -					    sc->sc_splitmic ?
 -					        rs->rs_keyix - 32 : rs->rs_keyix
 -					);
@@ -37,7 +37,7 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  			}
  			/*
  			 * Reject error frames if we have no vaps that
-@@ -6494,8 +6479,9 @@
+@@ -6562,8 +6547,9 @@
  		/*
  		 * Finished monitor mode handling, now reject
  		 * error frames before passing to other vaps
@@ -48,7 +48,7 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  			ieee80211_dev_kfree_skb(&skb);
  			goto rx_next;
  		}
-@@ -6503,6 +6489,26 @@
+@@ -6571,6 +6557,26 @@
  		/* remove the CRC */
  		skb_trim(skb, skb->len - IEEE80211_CRC_LEN);
  
@@ -75,18 +75,18 @@ Index: madwifi-dfs-r3053/ath/if_ath.c
  		/*
  		 * From this point on we assume the frame is at least
  		 * as large as ieee80211_frame_min; verify that.
-@@ -6524,6 +6530,7 @@
- 				   sc->sc_hwmap[rs->rs_rate].ieeerate,
- 				   rs->rs_rssi);
+@@ -6583,6 +6589,7 @@
+ 			goto rx_next;
+ 		}
  
 +		/* MIC failure. Drop the packet in any case */
  		/*
- 		 * Locate the node for sender, track state, and then
- 		 * pass the (referenced) node up to the 802.11 layer
-Index: madwifi-dfs-r3053/net80211/ieee80211_crypto_ccmp.c
+ 		 * Normal receive.
+ 		 */
+Index: madwifi-dfs-r3246/net80211/ieee80211_crypto_ccmp.c
 ===================================================================
---- madwifi-dfs-r3053.orig/net80211/ieee80211_crypto_ccmp.c	2007-12-13 05:25:12.634345457 +0100
-+++ madwifi-dfs-r3053/net80211/ieee80211_crypto_ccmp.c	2007-12-13 05:25:14.210435274 +0100
+--- madwifi-dfs-r3246.orig/net80211/ieee80211_crypto_ccmp.c	2008-01-25 16:28:31.292323859 +0100
++++ madwifi-dfs-r3246/net80211/ieee80211_crypto_ccmp.c	2008-01-25 16:36:01.926004007 +0100
 @@ -73,7 +73,7 @@
  static int ccmp_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
  static int ccmp_decap(struct ieee80211_key *, struct sk_buff *, int);
@@ -105,10 +105,10 @@ Index: madwifi-dfs-r3053/net80211/ieee80211_crypto_ccmp.c
  {
  	return 1;
  }
-Index: madwifi-dfs-r3053/net80211/ieee80211_crypto.h
+Index: madwifi-dfs-r3246/net80211/ieee80211_crypto.h
 ===================================================================
---- madwifi-dfs-r3053.orig/net80211/ieee80211_crypto.h	2007-12-13 05:25:10.214207541 +0100
-+++ madwifi-dfs-r3053/net80211/ieee80211_crypto.h	2007-12-13 05:25:14.210435274 +0100
+--- madwifi-dfs-r3246.orig/net80211/ieee80211_crypto.h	2008-01-25 16:27:28.000000000 +0100
++++ madwifi-dfs-r3246/net80211/ieee80211_crypto.h	2008-01-25 16:36:01.926004007 +0100
 @@ -145,7 +145,7 @@
  	int (*ic_encap)(struct ieee80211_key *, struct sk_buff *, u_int8_t);
  	int (*ic_decap)(struct ieee80211_key *, struct sk_buff *, int);
@@ -131,10 +131,10 @@ Index: madwifi-dfs-r3053/net80211/ieee80211_crypto.h
  }
  
  /*
-Index: madwifi-dfs-r3053/net80211/ieee80211_crypto_none.c
+Index: madwifi-dfs-r3246/net80211/ieee80211_crypto_none.c
 ===================================================================
---- madwifi-dfs-r3053.orig/net80211/ieee80211_crypto_none.c	2007-12-13 05:25:10.218207770 +0100
-+++ madwifi-dfs-r3053/net80211/ieee80211_crypto_none.c	2007-12-13 05:25:14.214435503 +0100
+--- madwifi-dfs-r3246.orig/net80211/ieee80211_crypto_none.c	2008-01-25 16:27:28.000000000 +0100
++++ madwifi-dfs-r3246/net80211/ieee80211_crypto_none.c	2008-01-25 16:36:01.926004007 +0100
 @@ -52,7 +52,7 @@
  static int none_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
  static int none_decap(struct ieee80211_key *, struct sk_buff *, int);
@@ -153,10 +153,10 @@ Index: madwifi-dfs-r3053/net80211/ieee80211_crypto_none.c
  {
  	struct ieee80211vap *vap = k->wk_private;
  
-Index: madwifi-dfs-r3053/net80211/ieee80211_crypto_tkip.c
+Index: madwifi-dfs-r3246/net80211/ieee80211_crypto_tkip.c
 ===================================================================
---- madwifi-dfs-r3053.orig/net80211/ieee80211_crypto_tkip.c	2007-12-13 05:25:10.226208226 +0100
-+++ madwifi-dfs-r3053/net80211/ieee80211_crypto_tkip.c	2007-12-13 05:25:14.214435503 +0100
+--- madwifi-dfs-r3246.orig/net80211/ieee80211_crypto_tkip.c	2008-01-25 16:27:28.000000000 +0100
++++ madwifi-dfs-r3246/net80211/ieee80211_crypto_tkip.c	2008-01-25 16:36:01.930004236 +0100
 @@ -57,7 +57,7 @@
  static int tkip_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
  static int tkip_enmic(struct ieee80211_key *, struct sk_buff *, int);
@@ -184,10 +184,10 @@ Index: madwifi-dfs-r3053/net80211/ieee80211_crypto_tkip.c
  		struct ieee80211vap *vap = ctx->tc_vap;
  		u8 mic[IEEE80211_WEP_MICLEN];
  		u8 mic0[IEEE80211_WEP_MICLEN];
-Index: madwifi-dfs-r3053/net80211/ieee80211_crypto_wep.c
+Index: madwifi-dfs-r3246/net80211/ieee80211_crypto_wep.c
 ===================================================================
---- madwifi-dfs-r3053.orig/net80211/ieee80211_crypto_wep.c	2007-12-13 05:25:10.234208681 +0100
-+++ madwifi-dfs-r3053/net80211/ieee80211_crypto_wep.c	2007-12-13 05:25:14.214435503 +0100
+--- madwifi-dfs-r3246.orig/net80211/ieee80211_crypto_wep.c	2008-01-25 16:27:28.000000000 +0100
++++ madwifi-dfs-r3246/net80211/ieee80211_crypto_wep.c	2008-01-25 16:36:01.930004236 +0100
 @@ -54,7 +54,7 @@
  static int wep_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
  static int wep_decap(struct ieee80211_key *, struct sk_buff *, int);
@@ -206,11 +206,11 @@ Index: madwifi-dfs-r3053/net80211/ieee80211_crypto_wep.c
  {
  	return 1;
  }
-Index: madwifi-dfs-r3053/net80211/ieee80211_input.c
+Index: madwifi-dfs-r3246/net80211/ieee80211_input.c
 ===================================================================
---- madwifi-dfs-r3053.orig/net80211/ieee80211_input.c	2007-12-13 05:25:13.938419772 +0100
-+++ madwifi-dfs-r3053/net80211/ieee80211_input.c	2007-12-13 05:25:14.218435729 +0100
-@@ -646,7 +646,7 @@
+--- madwifi-dfs-r3246.orig/net80211/ieee80211_input.c	2008-01-25 16:35:46.341115878 +0100
++++ madwifi-dfs-r3246/net80211/ieee80211_input.c	2008-01-25 16:36:01.934004465 +0100
+@@ -669,7 +669,7 @@
  		 * Next strip any MSDU crypto bits.
  		 */
  		if (key != NULL &&
@@ -219,7 +219,7 @@ Index: madwifi-dfs-r3053/net80211/ieee80211_input.c
  			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  				ni->ni_macaddr, "data", "%s", "demic error");
  			IEEE80211_NODE_STAT(ni, rx_demicfail);
-@@ -4168,6 +4168,47 @@
+@@ -4221,6 +4221,47 @@
  }
  #endif
  
@@ -267,11 +267,11 @@ Index: madwifi-dfs-r3053/net80211/ieee80211_input.c
  #ifdef IEEE80211_DEBUG
  /*
   * Debugging support.
-Index: madwifi-dfs-r3053/net80211/ieee80211_proto.h
+Index: madwifi-dfs-r3246/net80211/ieee80211_proto.h
 ===================================================================
---- madwifi-dfs-r3053.orig/net80211/ieee80211_proto.h	2007-12-13 05:25:10.246209365 +0100
-+++ madwifi-dfs-r3053/net80211/ieee80211_proto.h	2007-12-13 05:25:14.218435729 +0100
-@@ -91,6 +91,7 @@
+--- madwifi-dfs-r3246.orig/net80211/ieee80211_proto.h	2008-01-25 16:27:28.000000000 +0100
++++ madwifi-dfs-r3246/net80211/ieee80211_proto.h	2008-01-25 16:36:01.934004465 +0100
+@@ -90,6 +90,7 @@
  void ieee80211_set11gbasicrates(struct ieee80211_rateset *, enum ieee80211_phymode);
  enum ieee80211_phymode ieee80211_get11gbasicrates(struct ieee80211_rateset *);
  void ieee80211_send_pspoll(struct ieee80211_node *);
@@ -279,10 +279,10 @@ Index: madwifi-dfs-r3053/net80211/ieee80211_proto.h
  
  /*
   * Return the size of the 802.11 header for a management or data frame.
-Index: madwifi-dfs-r3053/net80211/ieee80211_linux.c
+Index: madwifi-dfs-r3246/net80211/ieee80211_linux.c
 ===================================================================
---- madwifi-dfs-r3053.orig/net80211/ieee80211_linux.c	2007-12-13 05:25:12.422333377 +0100
-+++ madwifi-dfs-r3053/net80211/ieee80211_linux.c	2007-12-13 05:25:14.218435729 +0100
+--- madwifi-dfs-r3246.orig/net80211/ieee80211_linux.c	2008-01-25 16:28:31.280323176 +0100
++++ madwifi-dfs-r3246/net80211/ieee80211_linux.c	2008-01-25 16:36:01.934004465 +0100
 @@ -337,8 +337,8 @@
  	/* TODO: needed parameters: count, keyid, key type, src address, TSC */
  	snprintf(buf, sizeof(buf), "%s(keyid=%d %scast addr=%s)", tag,
@@ -294,11 +294,11 @@ Index: madwifi-dfs-r3053/net80211/ieee80211_linux.c
  	memset(&wrqu, 0, sizeof(wrqu));
  	wrqu.data.length = strlen(buf);
  	wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
-Index: madwifi-dfs-r3053/net80211/ieee80211_output.c
+Index: madwifi-dfs-r3246/net80211/ieee80211_output.c
 ===================================================================
---- madwifi-dfs-r3053.orig/net80211/ieee80211_output.c	2007-12-13 05:25:10.262210276 +0100
-+++ madwifi-dfs-r3053/net80211/ieee80211_output.c	2007-12-13 05:25:14.222435959 +0100
-@@ -1092,13 +1092,16 @@
+--- madwifi-dfs-r3246.orig/net80211/ieee80211_output.c	2008-01-25 16:27:28.000000000 +0100
++++ madwifi-dfs-r3246/net80211/ieee80211_output.c	2008-01-25 16:36:01.938004695 +0100
+@@ -1083,13 +1083,16 @@
  			cip = (struct ieee80211_cipher *) key->wk_cipher;
  			ciphdrsize = cip->ic_header;
  			tailsize += (cip->ic_trailer + cip->ic_miclen);
@@ -318,11 +318,11 @@ Index: madwifi-dfs-r3053/net80211/ieee80211_output.c
  
  		/*
  		 * Allocate sk_buff for each subsequent fragment; First fragment
-Index: madwifi-dfs-r3053/net80211/ieee80211_node.c
+Index: madwifi-dfs-r3246/net80211/ieee80211_node.c
 ===================================================================
---- madwifi-dfs-r3053.orig/net80211/ieee80211_node.c	2007-12-13 05:25:13.938419772 +0100
-+++ madwifi-dfs-r3053/net80211/ieee80211_node.c	2007-12-13 05:25:14.222435959 +0100
-@@ -2236,11 +2236,13 @@
+--- madwifi-dfs-r3246.orig/net80211/ieee80211_node.c	2008-01-25 16:33:11.540294282 +0100
++++ madwifi-dfs-r3246/net80211/ieee80211_node.c	2008-01-25 16:36:01.938004695 +0100
+@@ -2259,11 +2259,13 @@
  	/* From this point onwards we can no longer find the node,
  	 * so no more references are generated
  	 */
diff --git a/package/madwifi/patches/311-bssid_alloc.patch b/package/madwifi/patches/311-bssid_alloc.patch
index 11ffe90f73..6d8fca404c 100644
--- a/package/madwifi/patches/311-bssid_alloc.patch
+++ b/package/madwifi/patches/311-bssid_alloc.patch
@@ -1,13 +1,13 @@
-Index: madwifi-dfs-r3053/ath/if_ath.c
+Index: madwifi-dfs-r3246/ath/if_ath.c
 ===================================================================
---- madwifi-dfs-r3053.orig/ath/if_ath.c	2007-12-20 23:43:22.845925726 +0100
-+++ madwifi-dfs-r3053/ath/if_ath.c	2007-12-20 23:43:30.570365916 +0100
-@@ -1320,7 +1320,7 @@
+--- madwifi-dfs-r3246.orig/ath/if_ath.c	2008-01-25 16:37:38.479506279 +0100
++++ madwifi-dfs-r3246/ath/if_ath.c	2008-01-25 16:38:04.684999652 +0100
+@@ -1345,7 +1345,7 @@
  		TAILQ_FOREACH(v, &ic->ic_vaps, iv_next)
- 			id_mask |= (1 << ATH_GET_VAP_ID(v->iv_myaddr, ic->ic_myaddr));
+ 			id_mask |= (1 << ATH_GET_VAP_ID(v->iv_myaddr));
  
--		for (id = 1; id < ATH_BCBUF; id++) {
-+		for (id = 0; id < ATH_BCBUF; id++) {
+-		for (id = 1; id < ath_maxvaps; id++) {
++		for (id = 0; id < ath_maxvaps; id++) {
  			/* get the first available slot */
  			if ((id_mask & (1 << id)) == 0) {
- 				ATH_SET_VAP_BSSID(vap->iv_myaddr, ic->ic_myaddr, id);
+ 				ATH_SET_VAP_BSSID(vap->iv_myaddr, id);