It's always supported packet injection for ath(4), in ahdemo. It's just fiddling and easily broken. It also absolutely doesn't work for 11n traffic. However, I've never, ever tested it so I can't say whether it's currently _functional_. :-P -adrian