Quick update on my progress with aircrack-ng...

I've been running aircrack in a Debian chroot. I compiled the needed "iw" software (to get airmon-ng working). I also had to make sure all the /dev/{shm,pts}'s and /sys was mounted with -o bind, as well as /proc.

With iw compiled and working, I can get the airmon-ng script to create a VAP interface (mon0) in monitor mode. This is where the strange behavior of the wl12x driver begins.

I like others have had a problem getting the card to see AP's in monitor mode other than channel 6. A few times, I have been able to run "airmon-ng start wlan0 11", and the card would actually monitor on channel 11. Strangely enough, the interface would die after trying injection tests or running airodump after doing this, where I've had to rmmod the driver and probe it out again, and start the process over.

A few times it has shown injection as working, but never have I seen success with the actual injection (it's always 0/30).

The bottom line is I think this driver sucks (wl12xx). It doesn't like to channel hop and I'm hoping that there are improvements in its future. I think the next step would be to compile a new driver (wl12xx and mac80211) from compat-wireless / John Linville tree and see how that goes .. although I still need to wrap my head around kernel building and flashing to the N900.