diff --git a/package/madwifi/Makefile b/package/madwifi/Makefile
index 0815c52d3b..117720fa4c 100644
--- a/package/madwifi/Makefile
+++ b/package/madwifi/Makefile
@@ -10,13 +10,16 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=madwifi
-PKG_VERSION:=r2978-20071127
-PKG_BRANCH:=madwifi-ng
+PKG_REV:=2996
+PKG_VERSION:=r$(PKG_REV)
+PKG_BRANCH:=madwifi-dfs
 PKG_RELEASE:=1
 
-PKG_SOURCE:=$(PKG_BRANCH)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=http://snapshots.madwifi.org/$(PKG_BRANCH)
-PKG_MD5SUM:=53d7e7c60caa4d613cf43763e33ce874
+PKG_SOURCE_PROTO:=svn
+PKG_SOURCE_VERSION:=$(PKG_REV)
+PKG_SOURCE_SUBDIR:=$(if $(PKG_BRANCH),$(PKG_BRANCH),madwifi)-$(PKG_VERSION)
+PKG_SOURCE_URL:=http://svn.madwifi.org/madwifi/$(if $(PKG_BRANCH),branches/$(PKG_BRANCH),trunk)
+PKG_SOURCE:=$(PKG_SOURCE_SUBDIR).tar.gz
 
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(PKG_BRANCH)-$(PKG_VERSION)
 
diff --git a/package/madwifi/patches/110-init_fix_PR_914.patch b/package/madwifi/patches/110-init_fix_PR_914.patch
deleted file mode 100644
index f14f53680a..0000000000
--- a/package/madwifi/patches/110-init_fix_PR_914.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-Index: madwifi-ng-r2834-20071106/ath/if_ath.c
-===================================================================
---- madwifi-ng-r2834-20071106.orig/ath/if_ath.c	2007-11-07 14:02:00.533401273 +0100
-+++ madwifi-ng-r2834-20071106/ath/if_ath.c	2007-11-07 14:02:00.957425434 +0100
-@@ -2122,7 +2122,10 @@
- 		ath_draintxq(sc);
- 		if (!sc->sc_invalid) {
- 			ath_stoprecv(sc);
-+
-+			/* XXX: this helps to avoid crashes on ifconfig down/up
- 			ath_hal_phydisable(ah);
-+			 */
- 		} else
- 			sc->sc_rxlink = NULL;
- 		ath_beacon_free(sc);		/* XXX needed? */
diff --git a/package/madwifi/patches/116-adhoc_beacon_PR_1033.patch b/package/madwifi/patches/116-adhoc_beacon_PR_1033.patch
deleted file mode 100644
index 8643f6a60f..0000000000
--- a/package/madwifi/patches/116-adhoc_beacon_PR_1033.patch
+++ /dev/null
@@ -1,197 +0,0 @@
-Index: madwifi-ng-r2834-20071106/ath/if_ath.c
-===================================================================
---- madwifi-ng-r2834-20071106.orig/ath/if_ath.c	2007-11-07 14:02:01.785472625 +0100
-+++ madwifi-ng-r2834-20071106/ath/if_ath.c	2007-11-07 14:02:02.637521177 +0100
-@@ -4559,16 +4559,31 @@
- 	struct ieee80211com *ic = &sc->sc_ic;
- 	struct ath_hal *ah = sc->sc_ah;
- 	struct ieee80211_node *ni;
--	u_int32_t nexttbtt, intval;
-+	u_int32_t nexttbtt = 0;
-+	u_int32_t intval;
-+	u_int64_t tsf, hw_tsf;
-+	u_int32_t tsftu, hw_tsftu;
-+	int should_reset_tsf = 0;
- 
- 	if (vap == NULL)
- 		vap = TAILQ_FIRST(&ic->ic_vaps);   /* XXX */
- 
- 	ni = vap->iv_bss;
- 
--	/* extract tstamp from last beacon and convert to TU */
--	nexttbtt = TSF_TO_TU(LE_READ_4(ni->ni_tstamp.data + 4),
--			     LE_READ_4(ni->ni_tstamp.data));
-+	hw_tsf = ath_hal_gettsf64(ah);
-+	tsf = le64_to_cpu(ni->ni_tstamp.tsf);
-+	hw_tsftu = hw_tsf >> 10;
-+	tsftu = tsf >> 10;
-+
-+	/* we should reset hw TSF only once, so we increment
-+	   ni_tstamp.tsf to avoid resetting the hw TSF multiple
-+	   times */
-+
-+	if (tsf == 0) {
-+		should_reset_tsf = 1;
-+		ni->ni_tstamp.tsf = cpu_to_le64(1);
-+	}
-+
- 	/* XXX conditionalize multi-bss support? */
- 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
- 		/*
-@@ -4582,20 +4597,61 @@
- 		if (sc->sc_stagbeacons)
- 			intval /= ATH_BCBUF;	/* for staggered beacons */
- 		if ((sc->sc_nostabeacons) &&
--		    (vap->iv_opmode == IEEE80211_M_HOSTAP))
--			nexttbtt = 0;
-+			(vap->iv_opmode == IEEE80211_M_HOSTAP))
-+			should_reset_tsf = 1;
- 	} else
- 		intval = ni->ni_intval & HAL_BEACON_PERIOD;
--	if (nexttbtt == 0)		/* e.g. for ap mode */
-+
-+#define	FUDGE	2
-+	sc->sc_syncbeacon = 0;
-+	if (should_reset_tsf) {
-+
-+		/* We just created the interface and TSF will be reset to
-+		   zero, so next beacon will be sent at the next intval
-+		   time */
-+
- 		nexttbtt = intval;
--	else if (intval)		/* NB: can be 0 for monitor mode */
--		nexttbtt = roundup(nexttbtt, intval);
--	DPRINTF(sc, ATH_DEBUG_BEACON, "%s: nexttbtt %u intval %u (%u)\n",
--		__func__, nexttbtt, intval, ni->ni_intval);
-+	} else if (intval) {	/* NB: can be 0 for monitor mode */
-+		if (tsf == 1) {
-+ 	
-+			/* We do not receive any beacons or probe response. Since
-+			   a beacon should be sent every 'intval' ms, we compute
-+			   the next beacon timestamp using the hardware TSF. We
-+			   ensure that it is at least FUDGE ms ahead of the
-+			   current TSF. Otherwise, we use the next beacon
-+			   timestamp again */
-+
-+			nexttbtt = roundup(hw_tsftu +1, intval);
-+			while (nexttbtt <= hw_tsftu + FUDGE) {
-+				nexttbtt += intval;
-+			}
-+		} else {
-+			if (tsf > hw_tsf) {
-+
-+			/* We do receive a beacon from someone else in the past,
-+			   but the hw TSF has not been updated (otherwise we
-+			   would have tsf >= hw_tsf). Since we cannot use the
-+			   hardware TSF, we will do nothing and wait for the
-+			   next beacon. In order to do so, we set sc->syncbeacon
-+			   again */
-+
-+				sc->sc_syncbeacon = 1;
-+				goto ath_beacon_config_debug;
-+			} else {
-+				/* We do receive a beacon in the past, normal case. We
-+				   make sure that the timestamp is at least FUDGE ms
-+				   ahead of the hardware TSF */
-+
-+				nexttbtt = tsftu + intval;
-+				while (nexttbtt <= hw_tsftu + FUDGE) {
-+					nexttbtt += intval;
-+				}
-+			}
-+		}
-+	}
-+
- 	if (ic->ic_opmode == IEEE80211_M_STA &&	!(sc->sc_nostabeacons)) {
- 		HAL_BEACON_STATE bs;
--		u_int64_t tsf;
--		u_int32_t tsftu;
- 		int dtimperiod, dtimcount;
- 		int cfpperiod, cfpcount;
- 
-@@ -4611,13 +4667,13 @@
- 			dtimcount = 0;		/* XXX? */
- 		cfpperiod = 1;			/* NB: no PCF support yet */
- 		cfpcount = 0;
--#define	FUDGE	2
- 		/*
- 		 * Pull nexttbtt forward to reflect the current
- 		 * TSF and calculate dtim+cfp state for the result.
- 		 */
--		tsf = ath_hal_gettsf64(ah);
--		tsftu = TSF_TO_TU(tsf>>32, tsf) + FUDGE;
-+		nexttbtt = tsftu;
-+		if (nexttbtt == 0)		/* e.g. for ap mode */
-+			nexttbtt = intval;
- 		do {
- 			nexttbtt += intval;
- 			if (--dtimcount < 0) {
-@@ -4625,7 +4681,7 @@
- 				if (--cfpcount < 0)
- 					cfpcount = cfpperiod - 1;
- 			}
--		} while (nexttbtt < tsftu);
-+		} while (nexttbtt < hw_tsftu + FUDGE);
- #undef FUDGE
- 		memset(&bs, 0, sizeof(bs));
- 		bs.bs_intval = intval;
-@@ -4677,7 +4733,7 @@
- 		DPRINTF(sc, ATH_DEBUG_BEACON,
- 			"%s: tsf %llu tsf:tu %u intval %u nexttbtt %u dtim %u nextdtim %u bmiss %u sleep %u cfp:period %u maxdur %u next %u timoffset %u\n",
- 			__func__,
--			(unsigned long long) tsf, tsftu,
-+			(unsigned long long) hw_tsf, hw_tsftu,
- 			bs.bs_intval,
- 			bs.bs_nexttbtt,
- 			bs.bs_dtimperiod,
-@@ -4699,7 +4755,7 @@
- 		ath_hal_intrset(ah, sc->sc_imask);
- 	} else {
- 		ath_hal_intrset(ah, 0);
--		if (nexttbtt == intval)
-+		if (should_reset_tsf)
- 			intval |= HAL_BEACON_RESET_TSF;
- 		if (ic->ic_opmode == IEEE80211_M_IBSS) {
- 			/*
-@@ -4736,8 +4792,40 @@
- 		if (ic->ic_opmode == IEEE80211_M_IBSS && sc->sc_hasveol)
- 			ath_beacon_start_adhoc(sc, vap);
- 	}
--	sc->sc_syncbeacon = 0;
- #undef TSF_TO_TU
-+
-+	ath_beacon_config_debug:
-+
-+	/* we print all debug messages here, in order to preserve the
-+	   time critical aspect of this function */
-+
-+	DPRINTF(sc, ATH_DEBUG_BEACON,
-+		"%s: ni=%p tsf=%llu hw_tsf=%llu tsftu=%u hw_tsftu=%u\n",
-+		__func__, ni, tsf, hw_tsf, tsftu, hw_tsftu);
-+
-+	if (should_reset_tsf) {
-+		/* we just created the interface */
-+		DPRINTF(sc, ATH_DEBUG_BEACON, "%s: first beacon\n",__func__);
-+	} else {
-+		if (tsf == 1) {
-+			/* we do not receive any beacons or probe response */
-+			DPRINTF(sc, ATH_DEBUG_BEACON,
-+				"%s: no beacon received...\n",__func__);
-+		} else {
-+			if (tsf > hw_tsf) {
-+				/* we do receive a beacon and the hw TSF has not been updated */
-+				DPRINTF(sc, ATH_DEBUG_BEACON,
-+					"%s: beacon received, but TSF is incorrect\n",__func__);
-+			} else {
-+				/* we do receive a beacon in the past, normal case */
-+				DPRINTF(sc, ATH_DEBUG_BEACON,
-+					"%s: beacon received, TSF is correct\n",__func__);
-+			}
-+		}
-+	}
-+
-+	DPRINTF(sc, ATH_DEBUG_BEACON, "%s: nexttbtt=%u intval=%u\n",
-+		__func__,nexttbtt, intval & HAL_BEACON_PERIOD);
- }
- 
- static int
diff --git a/package/madwifi/patches/121-ibss_hostap.patch b/package/madwifi/patches/121-ibss_hostap.patch
deleted file mode 100644
index ba54521397..0000000000
--- a/package/madwifi/patches/121-ibss_hostap.patch
+++ /dev/null
@@ -1,258 +0,0 @@
-Index: madwifi-ng-r2978-20071127/ath/if_ath.c
-===================================================================
---- madwifi-ng-r2978-20071127.orig/ath/if_ath.c	2007-11-27 21:18:24.910671912 +0100
-+++ madwifi-ng-r2978-20071127/ath/if_ath.c	2007-11-27 21:21:37.137626301 +0100
-@@ -515,7 +515,6 @@
-  */
- #define ATH_SET_VAP_BSSID_MASK(bssid_mask)				\
- 	((bssid_mask)[0] &= ~(((ATH_BCBUF-1) << 2) | 0x02))
--#define ATH_GET_VAP_ID(bssid)                   ((bssid)[0] >> 2)
- #define ATH_SET_VAP_BSSID(bssid, id)					\
- 		do {							\
- 			if (id)						\
-@@ -1203,7 +1202,11 @@
- 	case IEEE80211_M_IBSS:
- 		if ((sc->sc_nvaps != 0) && (ic->ic_opmode == IEEE80211_M_STA))
- 			return NULL;
--		ic_opmode = opmode;
-+		else if (sc->sc_nvaps == 0)
-+			ic_opmode = opmode;
-+		else
-+			ic_opmode = IEEE80211_M_HOSTAP;
-+		sc->sc_nibssvaps++;
- 		break;
- 	case IEEE80211_M_AHDEMO:
- 	case IEEE80211_M_MONITOR:
-@@ -1233,7 +1236,7 @@
- 		return NULL;
- 	}
- 
--	if (sc->sc_nvaps >= ATH_BCBUF) {
-+	if (sc->sc_nvaps + sc->sc_nibssvaps >= ATH_BCBUF) {
- 		printk(KERN_WARNING "too many virtual APs (already got %d)\n", 
- 				sc->sc_nvaps);
- 		return NULL;
-@@ -1288,6 +1291,7 @@
- 		/* Use RadioTAP interface type for monitor mode. */
- 		dev->type = ARPHRD_IEEE80211_RADIOTAP;
- 
-+	avp->av_bslot = -1;
- 	if ((flags & IEEE80211_CLONE_BSSID) && sc->sc_hasbmask) {
- 		struct ieee80211vap *v;
- 		unsigned int id_mask, id;
-@@ -1301,18 +1305,22 @@
- 
- 		/* do a full search to mark all the allocated VAPs */
- 		id_mask = 0;
--		TAILQ_FOREACH(v, &ic->ic_vaps, iv_next)
--			id_mask |= (1 << ATH_GET_VAP_ID(v->iv_myaddr));
-+		TAILQ_FOREACH(v, &ic->ic_vaps, iv_next) {
-+			struct ath_vap *a = (struct ath_vap *) v->iv_dev->priv;
-+			if (a->av_bslot >= 0)
-+				id_mask |= (1 << a->av_bslot);
-+		}
- 
--		for (id = 1; id < ATH_BCBUF; id++) {
-+		/* IBSS mode has local always set, so don't hand out beacon slot 0 to an IBSS vap */
-+		for (id = (opmode == IEEE80211_M_IBSS ? 1 : 0); id < ATH_BCBUF; id++) {
- 			/* get the first available slot */
- 			if ((id_mask & (1 << id)) == 0) {
- 				ATH_SET_VAP_BSSID(vap->iv_myaddr, id);
-+				avp->av_bslot = id;
- 				break;
- 			}
- 		}
- 	}
--	avp->av_bslot = -1;
- 	STAILQ_INIT(&avp->av_mcastq.axq_q);
- 	ATH_TXQ_LOCK_INIT(&avp->av_mcastq);
- 	if (opmode == IEEE80211_M_HOSTAP || opmode == IEEE80211_M_IBSS) {
-@@ -1322,33 +1330,14 @@
- 		 */
- 		avp->av_bcbuf = STAILQ_FIRST(&sc->sc_bbuf);
- 		STAILQ_REMOVE_HEAD(&sc->sc_bbuf, bf_list);
--		if (opmode == IEEE80211_M_HOSTAP || !sc->sc_hasveol) {
-+		if ((opmode == IEEE80211_M_IBSS) || (opmode == IEEE80211_M_HOSTAP) || !sc->sc_hasveol) {
- 			unsigned int slot;
--			/*
--			 * Assign the VAP to a beacon xmit slot.  As
--			 * above, this cannot fail to find one.
--			 */
--			avp->av_bslot = 0;
--			for (slot = 0; slot < ATH_BCBUF; slot++)
--				if (sc->sc_bslot[slot] == NULL) {
--					/*
--					 * XXX hack, space out slots to better
--					 * deal with misses
--					 */
--					if (slot + 1 < ATH_BCBUF &&
--					    sc->sc_bslot[slot+1] == NULL) {
--						avp->av_bslot = slot + 1;
--						break;
--					}
--					avp->av_bslot = slot;
--					/* NB: keep looking for a double slot */
--				}
- 			KASSERT(sc->sc_bslot[avp->av_bslot] == NULL,
- 				("beacon slot %u not empty?", avp->av_bslot));
- 			sc->sc_bslot[avp->av_bslot] = vap;
- 			sc->sc_nbcnvaps++;
- 		}
--		if ((opmode == IEEE80211_M_HOSTAP) && (sc->sc_hastsfadd)) {
-+		if ((sc->sc_opmode == IEEE80211_M_HOSTAP) && (sc->sc_hastsfadd)) {
- 			/*
- 			 * Multiple VAPs are to transmit beacons and we
- 			 * have h/w support for TSF adjusting; enable use
-@@ -1460,7 +1449,9 @@
- 			sc->sc_stagbeacons = 0;
- 	}
- 
--	if (vap->iv_opmode == IEEE80211_M_STA) {
-+	if (vap->iv_opmode == IEEE80211_M_IBSS) {
-+		sc->sc_nibssvaps--;
-+	} else if (vap->iv_opmode == IEEE80211_M_STA) {
- 		sc->sc_nstavaps--;
- 		sc->sc_nostabeacons = 0;
- 	} else if (vap->iv_opmode == IEEE80211_M_MONITOR)
-@@ -3816,7 +3807,7 @@
- 	    sc->sc_opmode == HAL_M_IBSS ||	/* NB: AHDEMO too */
- 	    (sc->sc_nostabeacons) || sc->sc_scanning)
- 		rfilt |= HAL_RX_FILTER_BEACON;
--	if (sc->sc_nmonvaps > 0)
-+	if ((sc->sc_nmonvaps > 0) || ((sc->sc_nvaps > 0) && (sc->sc_nibssvaps > 0)))
- 		rfilt |= (HAL_RX_FILTER_CONTROL | HAL_RX_FILTER_BEACON |
- 			  HAL_RX_FILTER_PROBEREQ | HAL_RX_FILTER_PROM);
- 	return rfilt;
-@@ -6284,12 +6275,20 @@
- 			type = ieee80211_input(ni, skb, rs->rs_rssi, bf->bf_tsf);
- 			ieee80211_unref_node(&ni);
- 		} else {
-+			const struct ieee80211_frame_min *wh = (const struct ieee80211_frame_min *) skb->data;
- 			/*
- 			 * No key index or no entry, do a lookup and
- 			 * add the node to the mapping table if possible.
- 			 */
--			ni = ieee80211_find_rxnode(ic,
--				(const struct ieee80211_frame_min *) skb->data);
-+			if (((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PROBE_REQ) &&
-+					(sc->sc_nibssvaps > 0))
-+				/* if this is a probe request, send it to all vaps
-+				 * when looking up nodes, hostap will be preferred over ibss,
-+				 * because ibss will catch all nodes */
-+				ni = NULL;
-+			else
-+				ni = ieee80211_find_rxnode(ic, (const struct ieee80211_frame_min *) skb->data);
-+
- 			if (ni != NULL) {
- 				struct ath_node *an = ATH_NODE(ni);
- 				ieee80211_keyix_t keyix;
-Index: madwifi-ng-r2978-20071127/ath/if_athvar.h
-===================================================================
---- madwifi-ng-r2978-20071127.orig/ath/if_athvar.h	2007-11-27 21:18:08.257722921 +0100
-+++ madwifi-ng-r2978-20071127/ath/if_athvar.h	2007-11-27 21:18:30.026963473 +0100
-@@ -209,7 +209,7 @@
- #define	ATH_RXBUF	40		/* number of RX buffers */
- #define	ATH_TXBUF	200		/* number of TX buffers */
- 
--#define	ATH_BCBUF	4		/* number of beacon buffers */
-+#define	ATH_BCBUF	8		/* number of beacon buffers */
- 
- /* free buffer threshold to restart net dev */
- #define	ATH_TXBUF_FREE_THRESHOLD  (ATH_TXBUF / 20)
-@@ -667,6 +667,7 @@
- 	u_int16_t sc_nvaps;			/* # of active virtual APs */
- 	u_int8_t sc_nstavaps;			/* # of active station VAPs */
- 	u_int8_t sc_nmonvaps;			/* # of monitor VAPs */
-+	u_int8_t sc_nibssvaps;			/* # of active ibss vaps */
- 	u_int8_t sc_nbcnvaps;			/* # of vaps sending beacons */
- 	u_int sc_fftxqmin;			/* aggregation threshold */
- 	HAL_INT sc_imask;			/* interrupt mask copy */
-Index: madwifi-ng-r2978-20071127/net80211/ieee80211_beacon.c
-===================================================================
---- madwifi-ng-r2978-20071127.orig/net80211/ieee80211_beacon.c	2007-11-27 21:18:08.265723374 +0100
-+++ madwifi-ng-r2978-20071127/net80211/ieee80211_beacon.c	2007-11-27 21:18:30.034963929 +0100
-@@ -111,7 +111,7 @@
- 	bo->bo_tim = frm;
- 
- 	/* IBSS/TIM */
--	if (vap->iv_opmode == IEEE80211_M_IBSS) {
-+	if (ic->ic_opmode == IEEE80211_M_IBSS) {
- 		*frm++ = IEEE80211_ELEMID_IBSSPARMS;
- 		*frm++ = 2;
- 		*frm++ = 0; *frm++ = 0;		/* TODO: ATIM window */
-Index: madwifi-ng-r2978-20071127/net80211/ieee80211_input.c
-===================================================================
---- madwifi-ng-r2978-20071127.orig/net80211/ieee80211_input.c	2007-11-27 21:18:08.269723596 +0100
-+++ madwifi-ng-r2978-20071127/net80211/ieee80211_input.c	2007-11-27 21:18:30.038964155 +0100
-@@ -3069,7 +3069,13 @@
- 			return;
- 		}
- 		if (ni == vap->iv_bss) {
--			if (vap->iv_opmode == IEEE80211_M_IBSS) {
-+			/* this probe request may have been sent to all vaps
-+			 * to give each a chance of creating a node for this.
-+			 * important for hostap+ibss mode */
-+			ni = ieee80211_find_rxnode(ic, (const struct ieee80211_frame_min *) skb->data);
-+			if (ni) {
-+				allocbs = 0;
-+			} else if (vap->iv_opmode == IEEE80211_M_IBSS) {
- 				/*
- 				 * XXX Cannot tell if the sender is operating
- 				 * in ibss mode.  But we need a new node to
-@@ -3078,12 +3084,13 @@
- 				 */
- 				ni = ieee80211_fakeup_adhoc_node(vap,
- 					wh->i_addr2);
-+				allocbs = 1;
- 			} else {
- 				ni = ieee80211_dup_bss(vap, wh->i_addr2, 1);
-+				allocbs = 1;
- 			}
- 			if (ni == NULL)
- 				return;
--			allocbs = 1;
- 		}
- 
- 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_INPUT, wh->i_addr2,
-Index: madwifi-ng-r2978-20071127/net80211/ieee80211_node.c
-===================================================================
---- madwifi-ng-r2978-20071127.orig/net80211/ieee80211_node.c	2007-11-27 21:18:08.281724279 +0100
-+++ madwifi-ng-r2978-20071127/net80211/ieee80211_node.c	2007-11-27 21:24:30.083481925 +0100
-@@ -1326,13 +1326,26 @@
- 	IEEE80211_NODE_TABLE_LOCK_ASSERT(nt);
- 
- 	hash = IEEE80211_NODE_HASH(macaddr);
-+
-+	/* look for non-ibss nodes first */
- 	LIST_FOREACH(ni, &nt->nt_hash[hash], ni_hash) {
--		if (IEEE80211_ADDR_EQ(ni->ni_macaddr, macaddr)) {
-+		if (IEEE80211_ADDR_EQ(ni->ni_macaddr, macaddr) && ni->ni_vap->iv_opmode != IEEE80211_M_IBSS) {
- #ifdef IEEE80211_DEBUG_REFCNT
- 			ieee80211_ref_node_debug(ni, func, line);
- #else
- 			ieee80211_ref_node(ni);
--#endif 
-+#endif
-+			return ni;
-+		}
-+	}
-+
-+	LIST_FOREACH(ni, &nt->nt_hash[hash], ni_hash) {
-+		if (IEEE80211_ADDR_EQ(ni->ni_macaddr, macaddr) && ni->ni_vap->iv_opmode == IEEE80211_M_IBSS) {
-+#ifdef IEEE80211_DEBUG_REFCNT
-+			ieee80211_ref_node_debug(ni, func, line);
-+#else
-+			ieee80211_ref_node(ni);
-+#endif
- 			return ni;
- 		}
- 	}
-@@ -1345,7 +1358,7 @@
- 			return ieee80211_ref_node_debug(wds->wds_ni, func, line);
- #else
- 			return ieee80211_ref_node(wds->wds_ni);
--#endif 
-+#endif
- 		}
- 	}
- 	return NULL;
diff --git a/package/madwifi/patches/127-regaccess.patch b/package/madwifi/patches/127-regaccess.patch
new file mode 100644
index 0000000000..a1fd96cc6d
--- /dev/null
+++ b/package/madwifi/patches/127-regaccess.patch
@@ -0,0 +1,312 @@
+Index: madwifi-dfs-r2996/ath_hal/ah_os.h
+===================================================================
+--- madwifi-dfs-r2996.orig/ath_hal/ah_os.h	2007-12-01 19:36:04.943396719 +0100
++++ madwifi-dfs-r2996/ath_hal/ah_os.h	2007-12-01 19:37:06.182886560 +0100
+@@ -33,7 +33,7 @@
+  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+  * THE POSSIBILITY OF SUCH DAMAGES.
+  *
+- * $Id: ah_os.h 2727 2007-10-05 17:42:53Z mtaylor $
++ * $Id: ah_os.h 2933 2007-11-23 09:38:18Z proski $
+  */
+ #ifndef _ATH_AH_OS_H_
+ #define _ATH_AH_OS_H_
+@@ -42,16 +42,16 @@
+  * Atheros Hardware Access Layer (HAL) OS Dependent Definitions.
+  */
+ 
+-/* 
+-MadWifi safe register operations:
++/*
++   MadWifi safe register operations:
+ 
+-	When hacking on registers directly we need to use the macros
+-	below, to avoid concurrent PCI access and abort mode errors.
++	When hacking on registers directly, we need to use the macros below to
++	avoid concurrent PCI access and abort mode errors.
+ 
+ 	* ath_reg_read
+ 	* ATH_REG_WRITE
+ 
+-HAL-ONLY register operations: 
++   HAL-ONLY register operations:
+ 
+ 	* _OS_REG_READ
+ 	* _OS_REG_WRITE
+@@ -60,26 +60,27 @@
+ 	* ath_hal_reg_read.
+ 	* ath_hal_reg_write
+ 
+-	When compiled in HAL:
+-		* We do not require locking overhead and function call unless user is debugging.
+-		* All HAL operations are executed in the context of a MadWifi wrapper call which holds 
+-		  the HAL lock.
+-		* Normally HAL is build with the non-modified version of this file so it doesnt have our 
+-		  funny macros anyway.
+-
+-	When compiled in MadWifi:
+-		* The HAL wrapper API takes the HAL lock before invoking the HAL.
+-		* HAL access is already protected, and MadWifi must NOT access the functions listed above.
+-
++    When compiled in HAL:
++	* We don't require locking overhead and function call except for
++	  debugging.
++	* All HAL operations are executed in the context of a MadWifi wrapper
++	  call that holds the HAL lock.
++	* Normally HAL is built with the non-modified version of this file, so
++	  it doesn't have our funny macros anyway.
++
++    When compiled in MadWifi:
++	* The HAL wrapper API takes the HAL lock before invoking the HAL.
++	* HAL access is already protected, and MadWifi must NOT access the
++	  functions listed above.
+ */
+ 
+ /*
+- * When building the HAL proper we use no GPL-contaminated include
+- * files and must define these types ourself.  Beware of these being
+- * mismatched against the contents of <linux/types.h>
++ * When building the HAL proper, we use no GPL-licensed include files and must
++ * define Linux types ourselves.  Please note that the definitions below don't
++ * exactly match those in <linux/types.h>
+  */
+ #ifndef _LINUX_TYPES_H
+-/* NB: arm defaults to unsigned so be explicit */
++/* NB: ARM defaults to unsigned, so be explicit */
+ typedef signed char		int8_t;
+ typedef short			int16_t;
+ typedef int			int32_t;
+@@ -93,36 +94,33 @@
+ typedef unsigned int		size_t;
+ typedef unsigned int		u_int;
+ typedef	void*			va_list;
+-#endif
++#endif				/* !_LINUX_TYPES_H */
+ 
+ /*
+  * Linux/BSD gcc compatibility shims.
+  */
+-#define	__printflike(_a,_b) \
+-	__attribute__ ((__format__ (__printf__, _a, _b)))
+-#define	__va_list	va_list 
++#define	__va_list	va_list
+ #define	OS_INLINE	__inline
+ 
+ extern int ath_hal_dma_beacon_response_time;
+ extern int ath_hal_sw_beacon_response_time;
+ extern int ath_hal_additional_swba_backoff;
+ 
+-void __ahdecl ath_hal_vprintf(struct ath_hal *ah, const char* fmt,
+-			      va_list ap);
+-void __ahdecl ath_hal_printf(struct ath_hal *ah, const char* fmt, ...);
+-const char* __ahdecl ath_hal_ether_sprintf(const u_int8_t *mac);
++void __ahdecl ath_hal_vprintf(struct ath_hal *ah, const char *fmt, va_list ap);
++void __ahdecl ath_hal_printf(struct ath_hal *ah, const char *fmt, ...);
++const char *__ahdecl ath_hal_ether_sprintf(const u_int8_t *mac);
+ int __ahdecl ath_hal_memcmp(const void *a, const void *b, size_t n);
+-void * __ahdecl ath_hal_malloc(size_t size);
+-void __ahdecl ath_hal_free(void* p);
++void *__ahdecl ath_hal_malloc(size_t size);
++void __ahdecl ath_hal_free(void *p);
+ 
+ /* Delay n microseconds. */
+-extern	void __ahdecl ath_hal_delay(int);
++extern void __ahdecl ath_hal_delay(int);
+ #define	OS_DELAY(_n)		ath_hal_delay(_n)
+ 
+ #define	OS_MEMZERO(_a, _n)	ath_hal_memzero((_a), (_n))
+ extern void __ahdecl ath_hal_memzero(void *, size_t);
+ #define	OS_MEMCPY(_d, _s, _n)	ath_hal_memcpy(_d,_s,_n)
+-extern void * __ahdecl ath_hal_memcpy(void *, const void *, size_t);
++extern void *__ahdecl ath_hal_memcpy(void *, const void *, size_t);
+ 
+ #ifndef abs
+ #define	abs(_a)			__builtin_abs(_a)
+@@ -133,7 +131,7 @@
+ #endif
+ 
+ struct ath_hal;
+-extern	u_int32_t __ahdecl ath_hal_getuptime(struct ath_hal *);
++extern u_int32_t __ahdecl ath_hal_getuptime(struct ath_hal *);
+ #define	OS_GETUPTIME(_ah)	ath_hal_getuptime(_ah)
+ 
+ /* Byte order/swapping support. */
+@@ -142,9 +140,8 @@
+ 
+ #ifndef AH_BYTE_ORDER
+ /*
+- * When the .inc file is not available (e.g. when building
+- * in a kernel source tree); look for some other way to
+- * setup the host byte order.
++ * When the .inc file is not available (e.g. when building in the kernel source
++ * tree), look for some other way to determine the host byte order.
+  */
+ #ifdef __LITTLE_ENDIAN
+ #define	AH_BYTE_ORDER	AH_LITTLE_ENDIAN
+@@ -155,93 +152,98 @@
+ #ifndef AH_BYTE_ORDER
+ #error "Do not know host byte order"
+ #endif
+-#endif /* AH_BYTE_ORDER */
++#endif				/* AH_BYTE_ORDER */
+ 
+ /*
+- * Note that register accesses are done using target-specific 
+- * functions when debugging is enabled (AH_DEBUG) or we are 
+- * explicitly configured this way.
+- *
+- * The hardware registers are native little-endian byte order.
+- * Big-endian hosts are handled by enabling hardware byte-swap
+- * of register reads and writes at reset.  But the PCI clock
+- * domain registers are not byte swapped!  Thus, on big-endian
+- * platforms we have to byte-swap thoese registers specifically.
+- * Most of this code is collapsed at compile time because the
+- * register values are constants.
+- *
+- * Presumably when talking about hardware byte-swapping, the above
+- * text is referring to the Atheros chipset, as the registers 
+- * referred to are in the PCI memory address space, and these are
+- * never byte-swapped by PCI chipsets or bridges, but always 
+- * written directly (i.e. the format defined by the manufacturer).
++ * Some big-endian architectures don't set CONFIG_GENERIC_IOMAP, but fail to
++ * implement iowrite32be and ioread32be.  Provide compatibility macros when
++ * it's needed.
++ *
++ * As of Linux 2.6.24, only MIPS, PARISC and PowerPC implement iowrite32be and
++ * ioread32be as functions.
++ *
++ * The downside or the replacement macros it that we may be byte-swapping data
++ * for the second time, so the native implementations should be preferred.
+  */
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,12)) && \
++	!defined(CONFIG_GENERIC_IOMAP) && (AH_BYTE_ORDER == AH_BIG_ENDIAN) && \
++	!defined(__mips__) && !defined(__hppa__) && !defined(__powerpc__)
++# ifndef iowrite32be
++#  define iowrite32be(_val, _addr) iowrite32(swab32((_val)), (_addr))
++# endif
++# ifndef ioread32be
++#  define ioread32be(_addr) swab32(ioread32((_addr)))
++# endif
++#endif
++
++/*
++ * The register accesses are done using target-specific functions when
++ * debugging is enabled (AH_DEBUG) or it's explicitly requested for the target.
++ *
++ * The hardware registers use little-endian byte order natively.  Big-endian
++ * systems are configured by HAL to enable hardware byte-swap of register reads
++ * and writes at reset.  This avoid the need to byte-swap the data in software.
++ * However, the registers in a certain area from 0x4000 to 0x4fff (PCI clock
++ * domain registers) are not byte swapped!
++ *
++ * Since Linux I/O primitives default to little-endian operations, we only
++ * need to suppress byte-swapping on big-endian systems outside the area used
++ * by the PCI clock domain registers.
++ */
++#if (AH_BYTE_ORDER == AH_BIG_ENDIAN)
++#define is_reg_le(__reg) ((0x4000 <= (__reg) && (__reg) < 0x5000))
++#else
++#define is_reg_le(__reg) 1
++#endif
++
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,12)
+-# if (AH_BYTE_ORDER == AH_BIG_ENDIAN)
+ #define _OS_REG_WRITE(_ah, _reg, _val) do {			\
+-	(0x4000 <= (_reg) && (_reg) < 0x5000) ?			\
++	 is_reg_le(_reg) ?					\
+ 	 iowrite32((_val), (_ah)->ah_sh + (_reg)) :		\
+ 	 iowrite32be((_val), (_ah)->ah_sh + (_reg));		\
+ 	} while (0)
+ #define _OS_REG_READ(_ah, _reg)					\
+-	((0x4000 <= (_reg) && (_reg) < 0x5000) ?		\
++	(is_reg_le(_reg) ?					\
+ 	 ioread32((_ah)->ah_sh + (_reg)) :			\
+-	 ioread32be((_ah)->ah_sh + (_reg)));
+-# else /* AH_LITTLE_ENDIAN */
+-#define _OS_REG_WRITE(_ah, _reg, _val) do {			\
+-	iowrite32(_val, (_ah)->ah_sh + (_reg));			\
+-	} while (0)
+-#define _OS_REG_READ(_ah, _reg)					\
+-	ioread32((_ah)->ah_sh + (_reg))
+-	
+-# endif /* AH_BYTE_ORDER */
++	 ioread32be((_ah)->ah_sh + (_reg)))
+ #else
+-# if (AH_BYTE_ORDER == AH_BIG_ENDIAN)
+ #define _OS_REG_WRITE(_ah, _reg, _val) do {			\
+-	 writel((0x4000 <= (_reg) && (_reg) < 0x5000) ? 	\
++	 writel(is_reg_le(_reg) ? 				\
+ 	 	(_val) : cpu_to_le32(_val), 			\
+ 		(_ah)->ah_sh + (_reg));				\
+ 	} while (0)
+ #define _OS_REG_READ(_ah, _reg)					\
+-	((0x4000 <= (_reg) && (_reg) < 0x5000) ?		\
++	(is_reg_le(_reg) ?					\
+ 	 readl((_ah)->ah_sh + (_reg)) :				\
+ 	 cpu_to_le32(readl((_ah)->ah_sh + (_reg))))
+-# else /* AH_LITTLE_ENDIAN */
+-#define _OS_REG_WRITE(_ah, _reg, _val) do {			\
+-	writel(_val, (_ah)->ah_sh + (_reg));			\
+-	} while (0)
+-#define _OS_REG_READ(_ah, _reg)					\
+-	readl((_ah)->ah_sh + (_reg))
+-# endif /* AH_BYTE_ORDER */
+-#endif /* KERNEL_VERSON(2,6,12) */
+-
+-/* 
+-The functions in this section are not intended to be invoked by MadWifi driver
+-code, but by the HAL.  They are NOT safe for direct invocation when the 
+-sc->sc_hal_lock is not held.  Use ath_reg_read and ATH_REG_WRITE instead!
++#endif				/* KERNEL_VERSION(2,6,12) */
++
++/*
++ * The functions in this section are not intended to be invoked by MadWifi
++ * driver code, but by the HAL.  They are NOT safe to call directly when the
++ * sc->sc_hal_lock is not held.  Use ath_reg_read and ATH_REG_WRITE instead!
+ */
+ #if defined(AH_DEBUG) || defined(AH_REGOPS_FUNC) || defined(AH_DEBUG_ALQ)
+ #define	OS_REG_WRITE(_ah, _reg, _val)	ath_hal_reg_write(_ah, _reg, _val)
+ #define	OS_REG_READ(_ah, _reg)		ath_hal_reg_read(_ah, _reg)
+-extern	void __ahdecl ath_hal_reg_write(struct ath_hal *ah, u_int reg, u_int32_t val);
+-extern	u_int32_t __ahdecl ath_hal_reg_read(struct ath_hal *ah, u_int reg);
++extern void __ahdecl ath_hal_reg_write(struct ath_hal *ah, u_int reg,
++				       u_int32_t val);
++extern u_int32_t __ahdecl ath_hal_reg_read(struct ath_hal *ah, u_int reg);
+ #else
+ #define OS_REG_WRITE(_ah, _reg, _val)	_OS_REG_WRITE(_ah, _reg, _val)
+ #define OS_REG_READ(_ah, _reg)		_OS_REG_READ(_ah, _reg)
+-#endif /* AH_DEBUG || AH_REGFUNC || AH_DEBUG_ALQ */
++#endif				/* AH_DEBUG || AH_REGFUNC || AH_DEBUG_ALQ */
+ 
+ extern char *ath_hal_func;
+ static inline void ath_hal_set_function(const char *name)
+-#if defined(AH_DEBUG)
+ {
++#ifdef AH_DEBUG
+ 	ath_hal_func = (char *)name;
+-}
+-#else
+-{ }
+ #endif
++}
+ 
+ #ifdef AH_DEBUG_ALQ
+-extern	void __ahdecl OS_MARK(struct ath_hal *, u_int id, u_int32_t value);
++extern void __ahdecl OS_MARK(struct ath_hal *, u_int id, u_int32_t value);
+ #else
+ #define	OS_MARK(_ah, _id, _v)
+ #endif
+@@ -253,8 +255,9 @@
+  *     compiled with the default calling convention and are not called
+  *     from within the HAL.
+  */
+-extern	struct ath_hal *_ath_hal_attach(u_int16_t devid, HAL_SOFTC,
+-		HAL_BUS_TAG, HAL_BUS_HANDLE, HAL_STATUS*);
+-extern	void _ath_hal_detach(struct ath_hal *);
++extern struct ath_hal *_ath_hal_attach(u_int16_t devid, HAL_SOFTC,
++				       HAL_BUS_TAG, HAL_BUS_HANDLE,
++				       HAL_STATUS *);
++extern void _ath_hal_detach(struct ath_hal *);
+ 
+-#endif /* _ATH_AH_OSDEP_H_ */
++#endif				/* _ATH_AH_OSDEP_H_ */
diff --git a/package/madwifi/patches/200-no_debug.patch b/package/madwifi/patches/200-no_debug.patch
index 3497b78cf4..c7aeaae0ea 100644
--- a/package/madwifi/patches/200-no_debug.patch
+++ b/package/madwifi/patches/200-no_debug.patch
@@ -1,17 +1,17 @@
-Index: madwifi-ng-r2978-20071127/ath/if_ath.c
+Index: madwifi-dfs-r2996/ath/if_ath.c
 ===================================================================
---- madwifi-ng-r2978-20071127.orig/ath/if_ath.c	2007-11-27 21:43:39.632991016 +0100
-+++ madwifi-ng-r2978-20071127/ath/if_ath.c	2007-11-27 22:09:32.889506059 +0100
-@@ -67,7 +67,7 @@
- #include "if_media.h"
- #include "if_llc.h"
- 
+--- madwifi-dfs-r2996.orig/ath/if_ath.c	2007-12-01 18:53:03.204271791 +0100
++++ madwifi-dfs-r2996/ath/if_ath.c	2007-12-01 18:53:28.557716602 +0100
+@@ -42,7 +42,7 @@
+  * This software is derived from work of Atsushi Onoe; his contribution
+  * is greatly appreciated.
+  */
 -#define	AR_DEBUG
 +#undef	AR_DEBUG
+ #include "if_ath_debug.h"
+ #include "opt_ah.h"
  
- #include <net80211/ieee80211_var.h>
- #include <net80211/ieee80211_radiotap.h>
-@@ -535,9 +535,11 @@
+@@ -515,9 +515,11 @@
  	u_int8_t csz;
  
  	sc->devid = devid;
@@ -23,7 +23,7 @@ Index: madwifi-ng-r2978-20071127/ath/if_ath.c
  
  	/*
  	 * Cache line size is used to size and align various
-@@ -1268,12 +1270,14 @@
+@@ -1283,12 +1285,14 @@
  		/* If no default VAP debug flags are passed, allow a few to
  		 * transfer down from the driver to new VAPs so we can have load
  		 * time debugging for VAPs too. */
@@ -38,7 +38,7 @@ Index: madwifi-ng-r2978-20071127/ath/if_ath.c
  	}
  	ic->ic_debug = (sc->sc_default_ieee80211_debug & IEEE80211_MSG_IC);
  
-@@ -9872,9 +9876,11 @@
+@@ -10290,9 +10294,11 @@
  				/* XXX validate? */
  				sc->sc_ledpin = val;
  				break;
@@ -50,7 +50,7 @@ Index: madwifi-ng-r2978-20071127/ath/if_ath.c
  				break;
  			case ATH_TXANTENNA:
  				/*
-@@ -10183,9 +10189,11 @@
+@@ -10703,9 +10709,11 @@
  	}
  
  	/* initialize values */
@@ -62,10 +62,10 @@ Index: madwifi-ng-r2978-20071127/ath/if_ath.c
  	sc->sc_txantenna = 0;		/* default to auto-selection */
  	sc->sc_txintrperiod = ATH_TXQ_INTR_PERIOD;
  }
-Index: madwifi-ng-r2978-20071127/ath_rate/amrr/amrr.c
+Index: madwifi-dfs-r2996/ath_rate/amrr/amrr.c
 ===================================================================
---- madwifi-ng-r2978-20071127.orig/ath_rate/amrr/amrr.c	2007-10-31 06:39:41.000000000 +0100
-+++ madwifi-ng-r2978-20071127/ath_rate/amrr/amrr.c	2007-11-27 21:47:06.136758995 +0100
+--- madwifi-dfs-r2996.orig/ath_rate/amrr/amrr.c	2007-12-01 18:45:14.000000000 +0100
++++ madwifi-dfs-r2996/ath_rate/amrr/amrr.c	2007-12-01 18:53:06.076435466 +0100
 @@ -70,7 +70,7 @@
  
  #include "amrr.h"
@@ -75,10 +75,10 @@ Index: madwifi-ng-r2978-20071127/ath_rate/amrr/amrr.c
  #ifdef AMRR_DEBUG
  #define	DPRINTF(sc, _fmt, ...) do {					\
  	if (sc->sc_debug & 0x10)					\
-Index: madwifi-ng-r2978-20071127/ath_rate/minstrel/minstrel.c
+Index: madwifi-dfs-r2996/ath_rate/minstrel/minstrel.c
 ===================================================================
---- madwifi-ng-r2978-20071127.orig/ath_rate/minstrel/minstrel.c	2007-11-27 21:18:24.882670317 +0100
-+++ madwifi-ng-r2978-20071127/ath_rate/minstrel/minstrel.c	2007-11-27 21:47:06.140759225 +0100
+--- madwifi-dfs-r2996.orig/ath_rate/minstrel/minstrel.c	2007-12-01 18:47:14.336390946 +0100
++++ madwifi-dfs-r2996/ath_rate/minstrel/minstrel.c	2007-12-01 18:53:06.080435695 +0100
 @@ -117,7 +117,7 @@
  
  #include "minstrel.h"
@@ -88,10 +88,10 @@ Index: madwifi-ng-r2978-20071127/ath_rate/minstrel/minstrel.c
  #ifdef MINSTREL_DEBUG
  enum {
  		ATH_DEBUG_RATE		= 0x00000010	/* rate control */
-Index: madwifi-ng-r2978-20071127/ath_rate/onoe/onoe.c
+Index: madwifi-dfs-r2996/ath_rate/onoe/onoe.c
 ===================================================================
---- madwifi-ng-r2978-20071127.orig/ath_rate/onoe/onoe.c	2007-10-31 06:39:41.000000000 +0100
-+++ madwifi-ng-r2978-20071127/ath_rate/onoe/onoe.c	2007-11-27 21:47:06.144759451 +0100
+--- madwifi-dfs-r2996.orig/ath_rate/onoe/onoe.c	2007-12-01 18:45:14.000000000 +0100
++++ madwifi-dfs-r2996/ath_rate/onoe/onoe.c	2007-12-01 18:53:06.080435695 +0100
 @@ -66,7 +66,7 @@
  
  #include "onoe.h"
@@ -101,10 +101,10 @@ Index: madwifi-ng-r2978-20071127/ath_rate/onoe/onoe.c
  #ifdef ONOE_DEBUG
  enum {
  	ATH_DEBUG_RATE	= 0x00000010,	/* rate control */
-Index: madwifi-ng-r2978-20071127/ath_rate/sample/sample.c
+Index: madwifi-dfs-r2996/ath_rate/sample/sample.c
 ===================================================================
---- madwifi-ng-r2978-20071127.orig/ath_rate/sample/sample.c	2007-11-21 09:23:20.000000000 +0100
-+++ madwifi-ng-r2978-20071127/ath_rate/sample/sample.c	2007-11-27 21:47:06.148759680 +0100
+--- madwifi-dfs-r2996.orig/ath_rate/sample/sample.c	2007-12-01 18:45:14.000000000 +0100
++++ madwifi-dfs-r2996/ath_rate/sample/sample.c	2007-12-01 18:53:06.080435695 +0100
 @@ -68,7 +68,7 @@
  
  #include "sample.h"
@@ -114,10 +114,10 @@ Index: madwifi-ng-r2978-20071127/ath_rate/sample/sample.c
  #ifdef SAMPLE_DEBUG
  enum {
  	ATH_DEBUG_RATE		= 0x00000010,	/* rate control */
-Index: madwifi-ng-r2978-20071127/tools/do_multi.c
+Index: madwifi-dfs-r2996/tools/do_multi.c
 ===================================================================
---- madwifi-ng-r2978-20071127.orig/tools/do_multi.c	2007-11-27 21:18:24.826667124 +0100
-+++ madwifi-ng-r2978-20071127/tools/do_multi.c	2007-11-27 21:47:06.152759909 +0100
+--- madwifi-dfs-r2996.orig/tools/do_multi.c	2007-12-01 18:45:51.063645501 +0100
++++ madwifi-dfs-r2996/tools/do_multi.c	2007-12-01 18:53:06.080435695 +0100
 @@ -9,16 +9,20 @@
  
      progname = basename(argv[0]);
@@ -139,10 +139,10 @@ Index: madwifi-ng-r2978-20071127/tools/do_multi.c
      if(strcmp(progname, "athkey") == 0)
  	ret =  athkey_init(argc, argv);
      if(strcmp(progname, "athstats") == 0)
-Index: madwifi-ng-r2978-20071127/tools/Makefile
+Index: madwifi-dfs-r2996/tools/Makefile
 ===================================================================
---- madwifi-ng-r2978-20071127.orig/tools/Makefile	2007-11-27 21:18:24.826667124 +0100
-+++ madwifi-ng-r2978-20071127/tools/Makefile	2007-11-27 21:47:06.152759909 +0100
+--- madwifi-dfs-r2996.orig/tools/Makefile	2007-12-01 18:45:51.067645730 +0100
++++ madwifi-dfs-r2996/tools/Makefile	2007-12-01 18:53:06.084435926 +0100
 @@ -48,7 +48,7 @@
  
  
@@ -161,10 +161,10 @@ Index: madwifi-ng-r2978-20071127/tools/Makefile
  	ln -s -f madwifi_multi $$i; \
  	done
  
-Index: madwifi-ng-r2978-20071127/net80211/ieee80211_linux.h
+Index: madwifi-dfs-r2996/net80211/ieee80211_linux.h
 ===================================================================
---- madwifi-ng-r2978-20071127.orig/net80211/ieee80211_linux.h	2007-11-27 21:47:46.371051817 +0100
-+++ madwifi-ng-r2978-20071127/net80211/ieee80211_linux.h	2007-11-27 21:47:56.199611915 +0100
+--- madwifi-dfs-r2996.orig/net80211/ieee80211_linux.h	2007-12-01 18:45:14.000000000 +0100
++++ madwifi-dfs-r2996/net80211/ieee80211_linux.h	2007-12-01 18:53:06.084435926 +0100
 @@ -29,8 +29,8 @@
  #ifndef _NET80211_IEEE80211_LINUX_H_
  #define _NET80211_IEEE80211_LINUX_H_
diff --git a/package/madwifi/patches/300-napi_polling.patch b/package/madwifi/patches/300-napi_polling.patch
index d5d8ef8817..878c949c54 100644
--- a/package/madwifi/patches/300-napi_polling.patch
+++ b/package/madwifi/patches/300-napi_polling.patch
@@ -1,9 +1,9 @@
-Index: madwifi-ng-r2978-20071127/ath/if_ath.c
+Index: madwifi-dfs-r2996/ath/if_ath.c
 ===================================================================
---- madwifi-ng-r2978-20071127.orig/ath/if_ath.c	2007-11-27 21:47:06.136758995 +0100
-+++ madwifi-ng-r2978-20071127/ath/if_ath.c	2007-11-27 21:49:11.439899616 +0100
-@@ -183,7 +183,7 @@
- 	int, u_int64_t);
+--- madwifi-dfs-r2996.orig/ath/if_ath.c	2007-12-01 18:53:28.557716602 +0100
++++ madwifi-dfs-r2996/ath/if_ath.c	2007-12-01 18:54:22.276777879 +0100
+@@ -189,7 +189,7 @@
+ 	struct sk_buff *, int, int, u_int64_t);
  static void ath_setdefantenna(struct ath_softc *, u_int);
  static struct ath_txq *ath_txq_setup(struct ath_softc *, int, int);
 -static void ath_rx_tasklet(TQUEUE_ARG);
@@ -11,24 +11,24 @@ Index: madwifi-ng-r2978-20071127/ath/if_ath.c
  static int ath_hardstart(struct sk_buff *, struct net_device *);
  static int ath_mgtstart(struct ieee80211com *, struct sk_buff *);
  #ifdef ATH_SUPERG_COMP
-@@ -552,7 +552,6 @@
+@@ -534,7 +534,6 @@
  	ATH_TXBUF_LOCK_INIT(sc);
  	ATH_RXBUF_LOCK_INIT(sc);
  
 -	ATH_INIT_TQUEUE(&sc->sc_rxtq,     ath_rx_tasklet,	dev);
- 	ATH_INIT_TQUEUE(&sc->sc_txtq,	  ath_tx_tasklet,	dev);
+ 	ATH_INIT_TQUEUE(&sc->sc_txtq,     ath_tx_tasklet,	dev);
  	ATH_INIT_TQUEUE(&sc->sc_bmisstq,  ath_bmiss_tasklet,	dev);
  	ATH_INIT_TQUEUE(&sc->sc_bstucktq, ath_bstuck_tasklet,	dev);
 @@ -807,6 +806,8 @@
  	dev->set_mac_address = ath_set_mac_address;
  	dev->change_mtu = ath_change_mtu;
- 	dev->tx_queue_len = ATH_TXBUF - 1;		/* 1 for mgmt frame */
+ 	dev->tx_queue_len = ATH_TXBUF - ATH_TXBUF_MGT_RESERVED;
 +	dev->poll = ath_rx_poll;
 +	dev->weight = 64;
  #ifdef USE_HEADERLEN_RESV
  	dev->hard_header_len += sizeof(struct ieee80211_qosframe) +
  				sizeof(struct llc) +
-@@ -2014,6 +2015,7 @@
+@@ -2164,6 +2165,7 @@
  		(status & HAL_INT_RXPHY)   ? " HAL_INT_RXPHY"   : "",
  		(status & HAL_INT_SWBA)    ? " HAL_INT_SWBA"    : "");
  
@@ -36,7 +36,7 @@ Index: madwifi-ng-r2978-20071127/ath/if_ath.c
  	status &= sc->sc_imask;			/* discard unasked for bits */
  	if (status & HAL_INT_FATAL) {
  		sc->sc_stats.ast_hardware++;
-@@ -2051,7 +2053,14 @@
+@@ -2216,7 +2218,14 @@
  		}
  		if (status & (HAL_INT_RX | HAL_INT_RXPHY)) {
  			ath_uapsd_processtriggers(sc);
@@ -52,7 +52,7 @@ Index: madwifi-ng-r2978-20071127/ath/if_ath.c
  		}
  		if (status & HAL_INT_TX) {
  #ifdef ATH_SUPERG_DYNTURBO
-@@ -2077,6 +2086,11 @@
+@@ -2242,6 +2251,11 @@
  				}
  			}
  #endif
@@ -64,7 +64,7 @@ Index: madwifi-ng-r2978-20071127/ath/if_ath.c
  			ATH_SCHEDULE_TQUEUE(&sc->sc_txtq, &needmark);
  		}
  		if (status & HAL_INT_BMISS) {
-@@ -3750,10 +3764,10 @@
+@@ -3929,10 +3943,10 @@
  	 *
  	 * XXX Using in_softirq is not right since we might
  	 * be called from other soft irq contexts than
@@ -77,7 +77,7 @@ Index: madwifi-ng-r2978-20071127/ath/if_ath.c
  	netif_stop_queue(dev);
  }
  
-@@ -3766,7 +3780,7 @@
+@@ -3945,7 +3959,7 @@
  	DPRINTF(sc, ATH_DEBUG_KEYCACHE, "%s:\n", __func__);
  	netif_start_queue(dev);
  	if (!in_softirq())		/* NB: see above */
@@ -86,7 +86,7 @@ Index: madwifi-ng-r2978-20071127/ath/if_ath.c
  }
  
  /*
-@@ -6050,13 +6064,12 @@
+@@ -6252,13 +6266,12 @@
  	sc->sc_rxotherant = 0;
  }
  
@@ -102,7 +102,7 @@ Index: madwifi-ng-r2978-20071127/ath/if_ath.c
  	struct ath_buf *bf;
  	struct ath_softc *sc = dev->priv;
  	struct ieee80211com *ic = &sc->sc_ic;
-@@ -6068,8 +6081,11 @@
+@@ -6270,8 +6283,11 @@
  	unsigned int len;
  	int type;
  	u_int phyerr;
@@ -114,7 +114,7 @@ Index: madwifi-ng-r2978-20071127/ath/if_ath.c
  	do {
  		bf = STAILQ_FIRST(&sc->sc_rxbuf);
  		if (bf == NULL) {		/* XXX ??? can this happen */
-@@ -6093,6 +6109,13 @@
+@@ -6295,6 +6311,13 @@
  			/* NB: never process the self-linked entry at the end */
  			break;
  		}
@@ -128,7 +128,7 @@ Index: madwifi-ng-r2978-20071127/ath/if_ath.c
  		skb = bf->bf_skb;
  		if (skb == NULL) {
  			printk("%s: no skbuff (%s)\n", DEV_NAME(dev), __func__);
-@@ -6137,6 +6160,7 @@
+@@ -6339,6 +6362,7 @@
  				sc->sc_stats.ast_rx_phyerr++;
  				phyerr = rs->rs_phyerr & 0x1f;
  				sc->sc_stats.ast_rx_phy[phyerr]++;
@@ -136,7 +136,7 @@ Index: madwifi-ng-r2978-20071127/ath/if_ath.c
  			}
  			if (rs->rs_status & HAL_RXERR_DECRYPT) {
  				/*
-@@ -6342,9 +6366,33 @@
+@@ -6545,9 +6569,33 @@
  		STAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
  		ATH_RXBUF_UNLOCK_IRQ(sc);
  	} while (ath_rxbuf_init(sc, bf) == 0);
@@ -170,7 +170,7 @@ Index: madwifi-ng-r2978-20071127/ath/if_ath.c
  #undef PA2DESC
  }
  
-@@ -7964,11 +8012,22 @@
+@@ -8170,11 +8218,22 @@
  	struct net_device *dev = (struct net_device *)data;
  	struct ath_softc *sc = dev->priv;
  
@@ -193,7 +193,7 @@ Index: madwifi-ng-r2978-20071127/ath/if_ath.c
  	netif_wake_queue(dev);
  
  	if (sc->sc_softled)
-@@ -7985,6 +8044,7 @@
+@@ -8191,6 +8250,7 @@
  	struct net_device *dev = (struct net_device *)data;
  	struct ath_softc *sc = dev->priv;
  
@@ -201,7 +201,7 @@ Index: madwifi-ng-r2978-20071127/ath/if_ath.c
  	/*
  	 * Process each active queue.
  	 */
-@@ -8005,6 +8065,16 @@
+@@ -8211,6 +8271,16 @@
  	if (sc->sc_uapsdq && txqactive(sc->sc_ah, sc->sc_uapsdq->axq_qnum))
  		ath_tx_processq(sc, sc->sc_uapsdq);
  
@@ -218,7 +218,7 @@ Index: madwifi-ng-r2978-20071127/ath/if_ath.c
  	netif_wake_queue(dev);
  
  	if (sc->sc_softled)
-@@ -8022,6 +8092,7 @@
+@@ -8228,6 +8298,7 @@
  	unsigned int i;
  
  	/* Process each active queue. */
@@ -226,7 +226,7 @@ Index: madwifi-ng-r2978-20071127/ath/if_ath.c
  	for (i = 0; i < HAL_NUM_TX_QUEUES; i++)
  		if (ATH_TXQ_SETUP(sc, i) && txqactive(sc->sc_ah, i))
  			ath_tx_processq(sc, &sc->sc_txq[i]);
-@@ -8030,6 +8101,16 @@
+@@ -8236,6 +8307,16 @@
  		ath_tx_processq(sc, sc->sc_xrtxq);
  #endif
  
@@ -243,7 +243,7 @@ Index: madwifi-ng-r2978-20071127/ath/if_ath.c
  	netif_wake_queue(dev);
  
  	if (sc->sc_softled)
-@@ -8101,6 +8182,7 @@
+@@ -8310,6 +8391,7 @@
  ath_draintxq(struct ath_softc *sc)
  {
  	struct ath_hal *ah = sc->sc_ah;
@@ -251,7 +251,7 @@ Index: madwifi-ng-r2978-20071127/ath/if_ath.c
  	unsigned int i;
  
  	/* XXX return value */
-@@ -9675,9 +9757,9 @@
+@@ -10077,9 +10159,9 @@
  	dev->mtu = mtu;
  	if ((dev->flags & IFF_RUNNING) && !sc->sc_invalid) {
  		/* NB: the rx buffers may need to be reallocated */
@@ -263,10 +263,10 @@ Index: madwifi-ng-r2978-20071127/ath/if_ath.c
  	}
  	ATH_UNLOCK(sc);
  
-Index: madwifi-ng-r2978-20071127/ath/if_athvar.h
+Index: madwifi-dfs-r2996/ath/if_athvar.h
 ===================================================================
---- madwifi-ng-r2978-20071127.orig/ath/if_athvar.h	2007-11-27 21:43:39.616990105 +0100
-+++ madwifi-ng-r2978-20071127/ath/if_athvar.h	2007-11-27 21:48:18.536884841 +0100
+--- madwifi-dfs-r2996.orig/ath/if_athvar.h	2007-12-01 18:53:03.188270880 +0100
++++ madwifi-dfs-r2996/ath/if_athvar.h	2007-12-01 18:53:44.626632316 +0100
 @@ -50,6 +50,10 @@
  #include <asm/io.h>
  #include <linux/list.h>
@@ -278,7 +278,7 @@ Index: madwifi-ng-r2978-20071127/ath/if_athvar.h
  /*
   * Deduce if tasklets are available.  If not then
   * fall back to using the immediate work queue.
-@@ -699,7 +703,6 @@
+@@ -727,7 +731,6 @@
  	struct ath_buf *sc_rxbufcur;		/* current rx buffer */
  	u_int32_t *sc_rxlink;			/* link ptr in last RX desc */
  	spinlock_t sc_rxbuflock;
@@ -286,7 +286,7 @@ Index: madwifi-ng-r2978-20071127/ath/if_athvar.h
  	struct ATH_TQ_STRUCT sc_rxorntq;	/* rxorn intr tasklet */
  	u_int8_t sc_defant;			/* current default antenna */
  	u_int8_t sc_rxotherant;			/* RXs on non-default antenna */
-@@ -712,6 +715,7 @@
+@@ -740,6 +743,7 @@
  	u_int sc_txintrperiod;			/* tx interrupt batching */
  	struct ath_txq sc_txq[HAL_NUM_TX_QUEUES];
  	struct ath_txq *sc_ac2q[WME_NUM_AC];	/* WME AC -> h/w qnum */
@@ -294,7 +294,7 @@ Index: madwifi-ng-r2978-20071127/ath/if_athvar.h
  	struct ATH_TQ_STRUCT sc_txtq;		/* tx intr tasklet */
  	u_int8_t sc_grppoll_str[GRPPOLL_RATE_STR_LEN];
  	struct ath_descdma sc_bdma;		/* beacon descriptors */
-@@ -800,6 +804,8 @@
+@@ -852,6 +856,8 @@
  #define	ATH_TXBUF_LOCK_CHECK(_sc)
  #endif
  
@@ -303,11 +303,11 @@ Index: madwifi-ng-r2978-20071127/ath/if_athvar.h
  
  #define	ATH_RXBUF_LOCK_INIT(_sc)	spin_lock_init(&(_sc)->sc_rxbuflock)
  #define	ATH_RXBUF_LOCK_DESTROY(_sc)
-Index: madwifi-ng-r2978-20071127/net80211/ieee80211_input.c
+Index: madwifi-dfs-r2996/net80211/ieee80211_input.c
 ===================================================================
---- madwifi-ng-r2978-20071127.orig/net80211/ieee80211_input.c	2007-11-27 21:18:30.038964155 +0100
-+++ madwifi-ng-r2978-20071127/net80211/ieee80211_input.c	2007-11-27 21:50:39.616924535 +0100
-@@ -1173,7 +1173,7 @@
+--- madwifi-dfs-r2996.orig/net80211/ieee80211_input.c	2007-12-01 18:47:16.968540943 +0100
++++ madwifi-dfs-r2996/net80211/ieee80211_input.c	2007-12-01 18:53:44.638633004 +0100
+@@ -1178,7 +1178,7 @@
  			/* attach vlan tag */
  			struct ieee80211_node *ni_tmp = SKB_CB(skb)->ni;
  			if (vlan_hwaccel_receive_skb(skb, vap->iv_vlgrp, ni->ni_vlan) == NET_RX_DROP) {
@@ -316,7 +316,7 @@ Index: madwifi-ng-r2978-20071127/net80211/ieee80211_input.c
  				 * device was too busy */
  				if (ni_tmp != NULL) {
  					/* node reference was leaked */
-@@ -1184,8 +1184,8 @@
+@@ -1189,8 +1189,8 @@
  			skb = NULL; /* SKB is no longer ours */
  		} else {
  			struct ieee80211_node *ni_tmp = SKB_CB(skb)->ni;
@@ -327,7 +327,7 @@ Index: madwifi-ng-r2978-20071127/net80211/ieee80211_input.c
  				 * device was too busy */
  				if (ni_tmp != NULL) {
  					/* node reference was leaked */
-@@ -2294,8 +2294,8 @@
+@@ -2299,8 +2299,8 @@
  		skb1->protocol = __constant_htons(0x0019);  /* ETH_P_80211_RAW */
  
  		ni_tmp = SKB_CB(skb1)->ni;
@@ -338,11 +338,11 @@ Index: madwifi-ng-r2978-20071127/net80211/ieee80211_input.c
  			 * device was too busy */
  			if (ni_tmp != NULL) {
  				/* node reference was leaked */
-Index: madwifi-ng-r2978-20071127/net80211/ieee80211_monitor.c
+Index: madwifi-dfs-r2996/net80211/ieee80211_monitor.c
 ===================================================================
---- madwifi-ng-r2978-20071127.orig/net80211/ieee80211_monitor.c	2007-11-22 03:08:35.000000000 +0100
-+++ madwifi-ng-r2978-20071127/net80211/ieee80211_monitor.c	2007-11-27 21:49:58.518582476 +0100
-@@ -568,7 +568,7 @@
+--- madwifi-dfs-r2996.orig/net80211/ieee80211_monitor.c	2007-12-01 18:45:14.000000000 +0100
++++ madwifi-dfs-r2996/net80211/ieee80211_monitor.c	2007-12-01 18:53:44.642633230 +0100
+@@ -571,7 +571,7 @@
  			skb1->protocol = __constant_htons(0x0019); /* ETH_P_80211_RAW */
  
  			ni_tmp = SKB_CB(skb1)->ni;
diff --git a/package/madwifi/patches/305-pureg_fix.patch b/package/madwifi/patches/305-pureg_fix.patch
index 4afeb5b33a..d33bc589b1 100644
--- a/package/madwifi/patches/305-pureg_fix.patch
+++ b/package/madwifi/patches/305-pureg_fix.patch
@@ -1,8 +1,8 @@
-Index: madwifi-ng-r2834-20071106/ath/if_ath.c
+Index: madwifi-dfs-r2996/ath/if_ath.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/ath/if_ath.c	2007-11-07 14:02:05.117662515 +0100
-+++ madwifi-ng-r2834-20071106/ath/if_ath.c	2007-11-07 14:02:05.345675505 +0100
-@@ -3519,7 +3519,9 @@
+--- madwifi-dfs-r2996.orig/ath/if_ath.c	2007-12-01 18:54:22.276777879 +0100
++++ madwifi-dfs-r2996/ath/if_ath.c	2007-12-01 18:54:45.982128761 +0100
+@@ -3998,7 +3998,9 @@
  		rfilt |= HAL_RX_FILTER_PROM;
  	if (ic->ic_opmode == IEEE80211_M_STA ||
  	    sc->sc_opmode == HAL_M_IBSS ||	/* NB: AHDEMO too */
@@ -13,11 +13,11 @@ Index: madwifi-ng-r2834-20071106/ath/if_ath.c
  		rfilt |= HAL_RX_FILTER_BEACON;
  	if ((sc->sc_nmonvaps > 0) || ((sc->sc_nvaps > 0) && (sc->sc_nibssvaps > 0)))
  		rfilt |= (HAL_RX_FILTER_CONTROL | HAL_RX_FILTER_BEACON |
-Index: madwifi-ng-r2834-20071106/net80211/ieee80211_input.c
+Index: madwifi-dfs-r2996/net80211/ieee80211_input.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_input.c	2007-11-07 14:02:04.873648608 +0100
-+++ madwifi-ng-r2834-20071106/net80211/ieee80211_input.c	2007-11-07 14:02:05.349675734 +0100
-@@ -321,11 +321,12 @@
+--- madwifi-dfs-r2996.orig/net80211/ieee80211_input.c	2007-12-01 18:53:44.638633004 +0100
++++ madwifi-dfs-r2996/net80211/ieee80211_input.c	2007-12-01 18:54:45.986128992 +0100
+@@ -329,11 +329,12 @@
  				bssid = wh->i_addr3;
  			}
  			/*
@@ -32,7 +32,7 @@ Index: madwifi-ng-r2834-20071106/net80211/ieee80211_input.c
  				/*
  				 * allow MGT frames to vap->iv_xrvap.
  				 * this will allow roaming between  XR and normal vaps
-@@ -344,7 +345,8 @@
+@@ -352,7 +353,8 @@
  			}
  #else
  			if (!IEEE80211_ADDR_EQ(bssid, vap->iv_bss->ni_bssid) &&
@@ -42,16 +42,16 @@ Index: madwifi-ng-r2834-20071106/net80211/ieee80211_input.c
  				/* not interested in */
  				IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  					bssid, NULL, "%s", "not to bss");
-@@ -2550,7 +2552,7 @@
+@@ -2971,7 +2973,7 @@
  	u_int8_t *frm, *efrm;
- 	u_int8_t *ssid, *rates, *xrates, *wpa, *rsn, *wme, *ath;
+ 	u_int8_t *ssid, *rates, *xrates, *suppchan, *wpa, *rsn, *wme, *ath;
  	u_int8_t rate;
 -	int reassoc, resp, allocbs = 0;
 +	int reassoc, resp, allocbs = 0, has_erp = 0;
  	u_int8_t qosinfo;
  
- 	wh = (struct ieee80211_frame *) skb->data;
-@@ -2572,11 +2574,15 @@
+ 	if (ni_or_null == NULL)
+@@ -2996,11 +2998,15 @@
  		 *    o station mode when associated (to collect state
  		 *      updates such as 802.11g slot time), or
  		 *    o adhoc mode (to discover neighbors)
@@ -68,7 +68,7 @@ Index: madwifi-ng-r2834-20071106/net80211/ieee80211_input.c
  			vap->iv_stats.is_rx_mgtdiscard++;
  			return;
  		}
-@@ -2659,6 +2665,7 @@
+@@ -3083,6 +3089,7 @@
  					break;
  				}
  				scan.erp = frm[2];
@@ -76,7 +76,7 @@ Index: madwifi-ng-r2834-20071106/net80211/ieee80211_input.c
  				break;
  			case IEEE80211_ELEMID_RSN:
  				scan.rsn = frm;
-@@ -2876,6 +2883,20 @@
+@@ -3300,6 +3307,20 @@
  				ieee80211_bg_scan(vap);
  			return;
  		}
@@ -97,11 +97,11 @@ Index: madwifi-ng-r2834-20071106/net80211/ieee80211_input.c
  		/*
  		 * If scanning, just pass information to the scan module.
  		 */
-Index: madwifi-ng-r2834-20071106/net80211/ieee80211_node.c
+Index: madwifi-dfs-r2996/net80211/ieee80211_node.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_node.c	2007-11-07 14:02:02.873534629 +0100
-+++ madwifi-ng-r2834-20071106/net80211/ieee80211_node.c	2007-11-07 14:02:05.357676193 +0100
-@@ -332,10 +332,16 @@
+--- madwifi-dfs-r2996.orig/net80211/ieee80211_node.c	2007-12-01 18:47:16.968540943 +0100
++++ madwifi-dfs-r2996/net80211/ieee80211_node.c	2007-12-01 18:54:45.998129686 +0100
+@@ -380,10 +380,16 @@
  	/* Update country ie information */
  	ieee80211_build_countryie(ic);
  
@@ -120,10 +120,10 @@ Index: madwifi-ng-r2834-20071106/net80211/ieee80211_node.c
  
  	(void) ieee80211_sta_join1(PASS_NODE(ni));
  }
-Index: madwifi-ng-r2834-20071106/net80211/ieee80211_proto.c
+Index: madwifi-dfs-r2996/net80211/ieee80211_proto.c
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_proto.c	2007-11-07 14:01:59.041316241 +0100
-+++ madwifi-ng-r2834-20071106/net80211/ieee80211_proto.c	2007-11-07 14:02:05.357676193 +0100
+--- madwifi-dfs-r2996.orig/net80211/ieee80211_proto.c	2007-12-01 18:45:14.000000000 +0100
++++ madwifi-dfs-r2996/net80211/ieee80211_proto.c	2007-12-01 18:54:46.002129908 +0100
 @@ -586,6 +586,28 @@
  	{ 4, { 2, 4, 11, 22 } },	/* IEEE80211_MODE_TURBO_G (mixed b/g) */
  };
@@ -153,16 +153,15 @@ Index: madwifi-ng-r2834-20071106/net80211/ieee80211_proto.c
  /*
   * Mark the basic rates for the 11g rate table based on the
   * specified mode.  For 11b compatibility we mark only 11b
-Index: madwifi-ng-r2834-20071106/net80211/ieee80211_var.h
+Index: madwifi-dfs-r2996/net80211/ieee80211_var.h
 ===================================================================
---- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_var.h	2007-11-07 14:02:04.561630827 +0100
-+++ madwifi-ng-r2834-20071106/net80211/ieee80211_var.h	2007-11-07 14:02:05.361676419 +0100
-@@ -592,6 +592,8 @@
- void ieee80211_build_countryie(struct ieee80211com *);
- int ieee80211_media_setup(struct ieee80211com *, struct ifmedia *, u_int32_t,
- 	ifm_change_cb_t, ifm_stat_cb_t);
+--- madwifi-dfs-r2996.orig/net80211/ieee80211_var.h	2007-12-01 18:45:14.000000000 +0100
++++ madwifi-dfs-r2996/net80211/ieee80211_var.h	2007-12-01 18:55:00.502956262 +0100
+@@ -668,6 +668,7 @@
+ void ieee80211_build_sc_ie(struct ieee80211com *);
+ void ieee80211_dfs_action(struct ieee80211com *);
+ void ieee80211_expire_channel_non_occupancy_restrictions(struct ieee80211com *);
 +void ieee80211_setpuregbasicrates(struct ieee80211_rateset *rs);
-+
  
- /* Key update synchronization methods.  XXX should not be visible. */
- static __inline void
+ /*
+  * Iterate through ic_channels to enumerate all distinct ic_ieee channel numbers.