> would it be outlandish for me to suggest an ioctl
> to frob this?

Such ioctl should be issued to bpf device, not to device driver itself.
Otherwise, other listeners of the interface will be confused.
However, there is only one buffer shared among listeners.
I cannot figure out how we call bpf twice (before and after encap/decap)..

> there's an ioctl (SIOCSWAVELAN, i think) that allows you to construct
> arbitrary 802.11 frames.  at least...that's what it looked like to me.

I can't find such interface in -current, and buffer for SIOCSWAVELAN
has only 1024 bytes in length.

Atsushi Onoe