Index: sys/dev/ral/rt2860.c
===================================================================
--- sys/dev/ral/rt2860.c	(revision 234847)
+++ sys/dev/ral/rt2860.c	(working copy)
@@ -1605,10 +1605,7 @@ rt2860_tx(struct rt2860_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
 		ieee80211_radiotap_tx(vap, m);
 	}
 
-	if (hdrlen & 3)
-		pad = 4 - (hdrlen & 3);
-	else
-		pad = 0;
+	pad = (hdrlen + 3) & ~3;
 
 	/* copy and trim 802.11 header */
 	memcpy(txwi + 1, wh, hdrlen);
@@ -1667,7 +1664,7 @@ rt2860_tx(struct rt2860_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
 	/* first segment is TXWI + 802.11 header */
 	txd = &ring->txd[ring->cur];
 	txd->sdp0 = htole32(data->paddr);
-	txd->sdl0 = htole16(sizeof (struct rt2860_txwi) + hdrlen + pad);
+	txd->sdl0 = htole16(sizeof (struct rt2860_txwi) + pad);
 	txd->flags = qsel;
 
 	/* setup payload segments */
@@ -1776,7 +1773,7 @@ rt2860_tx_raw(struct rt2860_softc *sc, struct mbuf *m,
 	u_int hdrlen;
 	uint16_t dur;
 	uint8_t type, qsel, mcs, pid, tid, qid;
-	int i, nsegs, ntxds, rate, ridx, error;
+	int i, nsegs, ntxds, pad, rate, ridx, error;
 
 	/* the data pool contains at least one element, pick the first */
 	data = SLIST_FIRST(&sc->data_pool);
@@ -1860,6 +1857,8 @@ rt2860_tx_raw(struct rt2860_softc *sc, struct mbuf *m,
 		ieee80211_radiotap_tx(vap, m);
 	}
 
+	pad = (hdrlen + 3) & ~3;
+
 	/* copy and trim 802.11 header */
 	memcpy(txwi + 1, wh, hdrlen);
 	m_adj(m, hdrlen);
@@ -1917,7 +1916,7 @@ rt2860_tx_raw(struct rt2860_softc *sc, struct mbuf *m,
 	/* first segment is TXWI + 802.11 header */
 	txd = &ring->txd[ring->cur];
 	txd->sdp0 = htole32(data->paddr);
-	txd->sdl0 = htole16(sizeof (struct rt2860_txwi) + hdrlen);
+	txd->sdl0 = htole16(sizeof (struct rt2860_txwi) + pad);
 	txd->flags = qsel;
 
 	/* setup payload segments */
@@ -2336,7 +2335,6 @@ rt2860_scan_start(struct ieee80211com *ic)
 	    tmp & ~(RT2860_BCN_TX_EN | RT2860_TSF_TIMER_EN |
 	    RT2860_TBTT_TIMER_EN));
 	rt2860_set_gp_timer(sc, 0);
-	rt2860_set_bssid(sc, ifp->if_broadcastaddr);
 }
 
 static void
@@ -2346,10 +2344,10 @@ rt2860_scan_end(struct ieee80211com *ic)
 	struct rt2860_softc *sc = ifp->if_softc;
 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
 
-	rt2860_enable_tsf_sync(sc);
-	/* XXX keep local copy */
-	rt2860_set_bssid(sc, vap->iv_bss->ni_bssid);
-	rt2860_set_gp_timer(sc, 500);
+	if (vap->iv_state == IEEE80211_S_RUN) {
+		rt2860_enable_tsf_sync(sc);
+		rt2860_set_gp_timer(sc, 500);
+	}
 }
 
 static void
@@ -2359,7 +2357,7 @@ rt2860_set_channel(struct ieee80211com *ic)
 	struct rt2860_softc *sc = ifp->if_softc;
 
 	RAL_LOCK(sc);
-	rt2860_set_chan(sc, ieee80211_chan2ieee(ic, ic->ic_curchan));
+	rt2860_switch_chan(sc, ic->ic_curchan);
 	RAL_UNLOCK(sc);
 }