Do non-802.11 tcpdump and 802.11 tcpdump (not radio), so we can see what ether_input() gets. Also turn on sysctl net.wlan0.debug=0x08000000. Looks like most of packets sent by AP need mac level retry ... I assume a non-802.11 dump will will be the same but with you -y switch right ? Petr