diff -ru linux-3.2.6/net/mac80211/tx.c linux-source-3.2.6_bt5r2/net/mac80211/tx.c
--- linux-3.2.6/net/mac80211/tx.c	2012-02-13 11:17:29.000000000 -0800
+++ linux-source-3.2.6_bt5r2/net/mac80211/tx.c	2012-02-17 07:11:21.000000000 -0800
@@ -686,7 +686,8 @@
 	} else if (tx->sta)
 		tx->sta->last_tx_rate = txrc.reported_rate;
 
-	if (unlikely(!info->control.rates[0].count))
+	if (unlikely(!info->control.rates[0].count) ||
+	    info->flags & IEEE80211_TX_CTL_NO_ACK)
 		info->control.rates[0].count = 1;
 
 	if (WARN_ON_ONCE((info->control.rates[0].count > 1) &&
@@ -792,11 +793,19 @@
 
 	/*
 	 * Packet injection may want to control the sequence
-	 * number, if we have no matching interface then we
-	 * neither assign one ourselves nor ask the driver to.
+	 * number, so if an injected packet is found, skip
+	 * renumbering it. Also make the packet NO_ACK to avoid
+	 * excessive retries (ACKing and retrying should be
+	 * handled by the injecting application).
+	 * FIXME This may break hostapd and some other injectors.
+	 * This should be done using a radiotap flag.
 	 */
-	if (unlikely(info->control.vif->type == NL80211_IFTYPE_MONITOR))
+	if (unlikely((info->flags & IEEE80211_TX_CTL_INJECTED) &&
+	   !(tx->sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))) {
+		if (!ieee80211_has_morefrags(hdr->frame_control))
+			info->flags |= IEEE80211_TX_CTL_NO_ACK;
 		return TX_CONTINUE;
+	}
 
 	if (unlikely(ieee80211_is_ctl(hdr->frame_control)))
 		return TX_CONTINUE;
diff -ru linux-3.2.6/net/wireless/chan.c linux-source-3.2.6_bt5r2/net/wireless/chan.c
--- linux-3.2.6/net/wireless/chan.c	2012-02-13 11:17:29.000000000 -0800
+++ linux-source-3.2.6_bt5r2/net/wireless/chan.c	2012-02-17 07:10:38.000000000 -0800
@@ -82,9 +82,12 @@
 {
 	struct ieee80211_channel *chan;
 	int result;
+	struct wireless_dev *mon_dev = NULL;
 
-	if (wdev && wdev->iftype == NL80211_IFTYPE_MONITOR)
+	if (wdev && wdev->iftype == NL80211_IFTYPE_MONITOR) {
+		mon_dev = wdev;
 		wdev = NULL;
+	}
 
 	if (wdev) {
 		ASSERT_WDEV_LOCK(wdev);
@@ -131,5 +134,8 @@
 	if (wdev)
 		wdev->channel = chan;
 
+	if (mon_dev)
+		mon_dev->channel = chan;
+
 	return 0;
 }