Index: ieee80211_input.c
===================================================================
RCS file: /usr/ncvs/src/sys/net80211/ieee80211_input.c,v
retrieving revision 1.87
diff -u -r1.87 ieee80211_input.c
--- ieee80211_input.c	23 Jan 2006 21:02:48 -0000	1.87
+++ ieee80211_input.c	27 Feb 2006 18:56:17 -0000
@@ -1953,6 +1953,18 @@
 		 * If scanning, just pass information to the scan module.
 		 */
 		if (ic->ic_flags & IEEE80211_F_SCAN) {
+			if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
+				/*
+				 * Actively scanning a channel marked passive;
+				 * send a probe request now that we know there
+				 * is 802.11 traffic present.
+				 *
+				 * XXX check if the beacon we recv'd gives
+				 * us what we need and suppress the probe req
+				 */
+				ieee80211_probe_curchan(ic, 1);
+				ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
+			}
 			ieee80211_add_scan(ic, &scan, wh,
 				subtype, rssi, rstamp);
 			return;
Index: ieee80211_node.c
===================================================================
RCS file: /usr/ncvs/src/sys/net80211/ieee80211_node.c,v
retrieving revision 1.72
diff -u -r1.72 ieee80211_node.c
--- ieee80211_node.c	18 Jan 2006 19:56:17 -0000	1.72
+++ ieee80211_node.c	27 Feb 2006 19:00:09 -0000
@@ -321,6 +321,7 @@
 	 * flushing anything queued in the driver and below.
 	 */
 	ic->ic_mgt_timer = 0;
+	ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
 
 	chan = ic->ic_curchan;
 	do {
@@ -347,6 +348,31 @@
 	return 0;
 }
 
+/*
+ * Probe the curent channel, if allowed, while scanning.
+ * If the channel is not marked passive-only then send
+ * a probe request immediately.  Otherwise mark state and
+ * listen for beacons on the channel; if we receive something
+ * then we'll transmit a probe request.
+ */
+void
+ieee80211_probe_curchan(struct ieee80211com *ic, int force)
+{
+	struct ifnet *ifp = ic->ic_ifp;
+
+	if ((ic->ic_curchan->ic_flags & IEEE80211_CHAN_PASSIVE) == 0 || force) {
+		/*
+		 * XXX send both broadcast+directed probe request
+		 */
+		ieee80211_send_probereq(ic->ic_bss,
+			ic->ic_myaddr, ifp->if_broadcastaddr,
+			ifp->if_broadcastaddr,
+			ic->ic_des_essid, ic->ic_des_esslen,
+			ic->ic_opt_ie, ic->ic_opt_ie_len);
+	} else
+		ic->ic_flags_ext |= IEEE80211_FEXT_PROBECHAN;
+}
+
 static __inline void
 copy_bss(struct ieee80211_node *nbss, const struct ieee80211_node *obss)
 {
@@ -596,6 +622,7 @@
 		(ic->ic_flags & IEEE80211_F_ASCAN) ?  "active" : "passive");
 
 	ic->ic_flags &= ~(IEEE80211_F_SCAN | IEEE80211_F_ASCAN);
+	ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
 }
 
 /*
Index: ieee80211_node.h
===================================================================
RCS file: /usr/ncvs/src/sys/net80211/ieee80211_node.h,v
retrieving revision 1.23
diff -u -r1.23 ieee80211_node.h
--- ieee80211_node.h	4 Dec 2005 04:50:27 -0000	1.23
+++ ieee80211_node.h	27 Feb 2006 18:45:21 -0000
@@ -187,6 +187,7 @@
 
 void	ieee80211_begin_scan(struct ieee80211com *, int);
 int	ieee80211_next_scan(struct ieee80211com *);
+void	ieee80211_probe_curchan(struct ieee80211com *, int);
 void	ieee80211_create_ibss(struct ieee80211com*, struct ieee80211_channel *);
 void	ieee80211_reset_bss(struct ieee80211com *);
 void	ieee80211_cancel_scan(struct ieee80211com *);
Index: ieee80211_proto.c
===================================================================
RCS file: /usr/ncvs/src/sys/net80211/ieee80211_proto.c,v
retrieving revision 1.28
diff -u -r1.28 ieee80211_proto.c
--- ieee80211_proto.c	23 Jan 2006 21:02:49 -0000	1.28
+++ ieee80211_proto.c	27 Feb 2006 19:00:25 -0000
@@ -978,19 +978,11 @@
 			break;
 		case IEEE80211_S_SCAN:
 			/*
-			 * Scan next. If doing an active scan and the
-			 * channel is not marked passive-only then send
-			 * a probe request.  Otherwise just listen for
-			 * beacons on the channel.
+			 * Scan next. If doing an active scan probe
+			 * for the requested ap (if any).
 			 */
-			if ((ic->ic_flags & IEEE80211_F_ASCAN) &&
-			    (ic->ic_curchan->ic_flags & IEEE80211_CHAN_PASSIVE) == 0) {
-				ieee80211_send_probereq(ni,
-					ic->ic_myaddr, ifp->if_broadcastaddr,
-					ifp->if_broadcastaddr,
-					ic->ic_des_essid, ic->ic_des_esslen,
-					ic->ic_opt_ie, ic->ic_opt_ie_len);
-			}
+			if (ic->ic_flags & IEEE80211_F_ASCAN)
+				ieee80211_probe_curchan(ic, 0);
 			break;
 		case IEEE80211_S_RUN:
 			/* beacon miss */
Index: ieee80211_var.h
===================================================================
RCS file: /usr/ncvs/src/sys/net80211/ieee80211_var.h,v
retrieving revision 1.39
diff -u -r1.39 ieee80211_var.h
--- ieee80211_var.h	14 Feb 2006 17:48:56 -0000	1.39
+++ ieee80211_var.h	27 Feb 2006 18:56:00 -0000
@@ -254,6 +254,7 @@
 #define	IEEE80211_FEXT_BGSCAN	0x00000008	/* STATUS: enable full bgscan completion */
 #define	IEEE80211_FEXT_ERPUPDATE 0x00000200	/* STATUS: update ERP element */
 #define	IEEE80211_FEXT_SWBMISS	0x00000400	/* CONF: do bmiss in s/w */
+#define	IEEE80211_FEXT_PROBECHAN 0x00020000	/* CONF: probe passive channel*/
 
 /* ic_caps */
 #define	IEEE80211_C_WEP		0x00000001	/* CAPABILITY: WEP available */