Another update regarding the packet injection driver:

It seems that I finally found the firmware issue causing the bug in managed/station mode. It wasn't too easy to figure this out due to the closed-source firmware, but I found a workaround.
Today I have successfully verified it at various locations and now I am continuing with upgrading my phone to PR1.3 and forward-porting the patches to current wireless-testing.
If nothing went wrong I may release the driver before Christmas.