it seems wl1271 we plan to use in Neo900 is as close as it gets to having simple and working injection support, based on wl12xx drivers and firmware.
However if you're aware of a nice WLAN module (with (FCC) type approval) with decent interface (no USB please) and low power consumption, no more than 2.5mm height and full support by open documentation and free drivers that does all those goodies like injection and monitor mode and 5GHz we want, feel free to send me a pointer to the URL of the datasheet and the supplier where we can buy it. :-)
[edit] googling dug up http://www.spinics.net/lists/linux-w.../msg78413.html which has lots of references to wl1271, didn't check how far that actually implements something useful. Possibly wl1271 comes with paket injection supported OOTB?[/edit]

For MMS support, what's the problem? afaict the N900 already has frals' fmms or what's the name, and porting that to work with the excellently documented P*S8 AT interface instead of obscure BB5 cmt ISI interface should be really really simple.

[edit] sidenote: you're aware that Pyra and Neo900 are designed on same PC by same guy and use both the same modem module and possibly even same WLAN module? And that probably a lot of software working on pyra could work on Neo900 too, OOTB or after mere recompilation?[/edit]
/j