70 static	int hostap_input(struct ieee80211_node *ni, struct mbuf *m,
108 sta_disassoc(void *arg, struct ieee80211_node *ni)  in sta_disassoc()  argument
111 	if (ni->ni_associd != 0) {  in sta_disassoc()
112 		IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_DISASSOC,  in sta_disassoc()
114 		ieee80211_node_leave(ni);  in sta_disassoc()
119 sta_csa(void *arg, struct ieee80211_node *ni)  in sta_csa()  argument
121 	struct ieee80211vap *vap = ni->ni_vap;  in sta_csa()
123 	if (ni->ni_associd != 0)  in sta_csa()
124 		if (ni->ni_inact > vap->iv_inact_init) {  in sta_csa()
125 			ni->ni_inact = vap->iv_inact_init;  in sta_csa()
126 			IEEE80211_NOTE(vap, IEEE80211_MSG_INACT, ni,  in sta_csa()
127 			    "%s: inact %u", __func__, ni->ni_inact);  in sta_csa()
132 sta_drop(void *arg, struct ieee80211_node *ni)  in sta_drop()  argument
135 	if (ni->ni_associd != 0)  in sta_drop()
136 		ieee80211_node_leave(ni);  in sta_drop()
308 				struct ieee80211_node *ni = vap->iv_bss;  in hostap_newstate()  local
311 				    ether_sprintf(ni->ni_bssid));  in hostap_newstate()
312 				ieee80211_print_essid(ni->ni_essid,  in hostap_newstate()
313 				    ni->ni_esslen);  in hostap_newstate()
317 				    IEEE80211_RATE2MBS(ni->ni_txrate));  in hostap_newstate()
357 	struct ieee80211_node *ni, struct mbuf *m)  in hostap_deliver_data()  argument
372 	IEEE80211_NODE_STAT(ni, rx_data);  in hostap_deliver_data()
373 	IEEE80211_NODE_STAT_ADD(ni, rx_bytes, m->m_pkthdr.len);  in hostap_deliver_data()
376 		IEEE80211_NODE_STAT(ni, rx_mcast);  in hostap_deliver_data()
378 		IEEE80211_NODE_STAT(ni, rx_ucast);  in hostap_deliver_data()
435 		if (ni->ni_vlan != 0) {  in hostap_deliver_data()
437 			m->m_pkthdr.ether_vtag = ni->ni_vlan;  in hostap_deliver_data()
475 hostap_input(struct ieee80211_node *ni, struct mbuf *m,  in hostap_input()  argument
478 	struct ieee80211vap *vap = ni->ni_vap;  in hostap_input()
479 	struct ieee80211com *ic = ni->ni_ic;  in hostap_input()
515 	KASSERT(ni != NULL, ("null node"));  in hostap_input()
516 	ni->ni_inact = ni->ni_inact_reload;  in hostap_input()
522 		    ni->ni_macaddr, NULL,  in hostap_input()
537 		    ni->ni_macaddr, NULL, "wrong version, fc %02x:%02x",  in hostap_input()
554 				    IEEE80211_MSG_ANY, ni->ni_macaddr,  in hostap_input()
576 		IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);  in hostap_input()
577 		ni->ni_noise = nf;  in hostap_input()
583 			if (! ieee80211_check_rxseq(ni, wh, bssid, rxs))  in hostap_input()
594 			    ni->ni_macaddr, NULL,  in hostap_input()
617 		if (ni == vap->iv_bss) {  in hostap_input()
620 			ieee80211_send_error(ni, wh->i_addr2,  in hostap_input()
626 		if (ni->ni_associd == 0) {  in hostap_input()
629 			IEEE80211_SEND_MGMT(ni,  in hostap_input()
641 		    (ni->ni_flags & IEEE80211_NODE_PWR_MGT)))  in hostap_input()
642 			vap->iv_node_ps(ni,  in hostap_input()
649 		if (dir == IEEE80211_FC1_DIR_DSTODS && ni->ni_wdsvap == NULL) {  in hostap_input()
650 			if (!ieee80211_node_is_authorized(ni)) {  in hostap_input()
657 				IEEE80211_NODE_STAT(ni, rx_unauth);  in hostap_input()
660 			ieee80211_dwds_discover(ni, m);  in hostap_input()
671 		    ieee80211_ampdu_reorder(ni, m, rxs) != 0) {  in hostap_input()
693 				IEEE80211_NODE_STAT(ni, rx_noprivacy);  in hostap_input()
696 			if (ieee80211_crypto_decap(ni, m, hdrspace, &key) == 0) {  in hostap_input()
698 				IEEE80211_NODE_STAT(ni, rx_wepfail);  in hostap_input()
721 			m = ieee80211_defrag(ni, m, hdrspace, has_decrypted);  in hostap_input()
734 			    ni->ni_macaddr, "data", "%s", "demic error");  in hostap_input()
736 			IEEE80211_NODE_STAT(ni, rx_demicfail);  in hostap_input()
754 			    ni->ni_macaddr, "data", "%s", "decap error");  in hostap_input()
756 			IEEE80211_NODE_STAT(ni, rx_decap);  in hostap_input()
763 		if (!ieee80211_node_is_authorized(ni)) {  in hostap_input()
775 				    ni->ni_macaddr, "data", "unauthorized or "  in hostap_input()
780 				IEEE80211_NODE_STAT(ni, rx_unauth);  in hostap_input()
797 				IEEE80211_NODE_STAT(ni, rx_unencrypted);  in hostap_input()
803 			m = ieee80211_decap_amsdu(ni, m);  in hostap_input()
808 			m = ieee80211_decap_fastframe(vap, ni, m);  in hostap_input()
813 		if (dir == IEEE80211_FC1_DIR_DSTODS && ni->ni_wdsvap != NULL)  in hostap_input()
814 			ieee80211_deliver_data(ni->ni_wdsvap, ni, m);  in hostap_input()
816 			hostap_deliver_data(vap, ni, m);  in hostap_input()
821 		IEEE80211_NODE_STAT(ni, rx_mgmt);  in hostap_input()
830 			    ni->ni_macaddr, "mgt", "too short: len %u",  in hostap_input()
873 			if (ieee80211_crypto_decap(ni, m, hdrspace, &key) == 0) {  in hostap_input()
889 		vap->iv_recv_mgmt(ni, m, subtype, rxs, rssi, nf);  in hostap_input()
894 		IEEE80211_NODE_STAT(ni, rx_ctrl);  in hostap_input()
895 		vap->iv_recv_ctl(ni, m, subtype);  in hostap_input()
915 hostap_auth_open(struct ieee80211_node *ni, struct ieee80211_frame *wh,  in hostap_auth_open()  argument
918 	struct ieee80211vap *vap = ni->ni_vap;  in hostap_auth_open()
922 	if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {  in hostap_auth_open()
924 		    ni->ni_macaddr, "open auth",  in hostap_auth_open()
925 		    "bad sta auth mode %u", ni->ni_authmode);  in hostap_auth_open()
932 		if (ni->ni_challenge != NULL) {  in hostap_auth_open()
933 			IEEE80211_FREE(ni->ni_challenge, M_80211_NODE);  in hostap_auth_open()
934 			ni->ni_challenge = NULL;  in hostap_auth_open()
937 		ieee80211_send_error(ni, wh->i_addr2,   in hostap_auth_open()
947 	if (ni == vap->iv_bss) {  in hostap_auth_open()
948 		ni = ieee80211_dup_bss(vap, wh->i_addr2);  in hostap_auth_open()
949 		if (ni == NULL)  in hostap_auth_open()
951 	} else if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)  in hostap_auth_open()
952 		(void) ieee80211_ref_node(ni);  in hostap_auth_open()
958 	ni->ni_flags |= IEEE80211_NODE_AREF;  in hostap_auth_open()
963 	ni->ni_flags |= IEEE80211_NODE_ASSOCID;  in hostap_auth_open()
975 		    IEEE80211_MSG_AUTH | IEEE80211_MSG_ACL, ni->ni_macaddr,  in hostap_auth_open()
977 		ieee80211_notify_node_auth(ni);  in hostap_auth_open()
979 		IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);  in hostap_auth_open()
981 		    IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, ni->ni_macaddr,  in hostap_auth_open()
987 		if (ni->ni_authmode != IEEE80211_AUTH_8021X)  in hostap_auth_open()
988 			ieee80211_node_authorize(ni);  in hostap_auth_open()
993 hostap_auth_shared(struct ieee80211_node *ni, struct ieee80211_frame *wh,  in hostap_auth_shared()  argument
997 	struct ieee80211vap *vap = ni->ni_vap;  in hostap_auth_shared()
1013 		    ni->ni_macaddr, "shared key auth",  in hostap_auth_shared()
1023 	if (ni->ni_authmode != IEEE80211_AUTH_AUTO &&  in hostap_auth_shared()
1024 	    ni->ni_authmode != IEEE80211_AUTH_SHARED) {  in hostap_auth_shared()
1026 		    ni->ni_macaddr, "shared key auth",  in hostap_auth_shared()
1027 		    "bad sta auth mode %u", ni->ni_authmode);  in hostap_auth_shared()
1037 			    ni->ni_macaddr, "shared key auth",  in hostap_auth_shared()
1053 			    ni->ni_macaddr, "shared key auth",  in hostap_auth_shared()
1061 			    ni->ni_macaddr, "shared key auth",  in hostap_auth_shared()
1077 		if (ni == vap->iv_bss) {  in hostap_auth_shared()
1078 			ni = ieee80211_dup_bss(vap, wh->i_addr2);  in hostap_auth_shared()
1079 			if (ni == NULL) {  in hostap_auth_shared()
1087 			if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)  in hostap_auth_shared()
1088 				(void) ieee80211_ref_node(ni);  in hostap_auth_shared()
1098 		ni->ni_flags |= IEEE80211_NODE_AREF;  in hostap_auth_shared()
1103 		ni->ni_flags |= IEEE80211_NODE_ASSOCID;  in hostap_auth_shared()
1104 		IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);  in hostap_auth_shared()
1105 		ni->ni_noise = nf;  in hostap_auth_shared()
1106 		if (!ieee80211_alloc_challenge(ni)) {  in hostap_auth_shared()
1110 		net80211_get_random_bytes(ni->ni_challenge,  in hostap_auth_shared()
1113 		    ni, "shared key %sauth request", allocbs ? "" : "re");  in hostap_auth_shared()
1125 			    ni->ni_macaddr,  in hostap_auth_shared()
1127 			ieee80211_notify_node_auth(ni);  in hostap_auth_shared()
1133 		if (ni == vap->iv_bss) {  in hostap_auth_shared()
1135 			    ni->ni_macaddr, "shared key response",  in hostap_auth_shared()
1140 		if (ni->ni_challenge == NULL) {  in hostap_auth_shared()
1142 			    ni->ni_macaddr, "shared key response",  in hostap_auth_shared()
1148 		if (memcmp(ni->ni_challenge, &challenge[2],  in hostap_auth_shared()
1151 			    ni->ni_macaddr, "shared key response",  in hostap_auth_shared()
1158 		    ni, "%s", "station authenticated (shared key)");  in hostap_auth_shared()
1159 		ieee80211_node_authorize(ni);  in hostap_auth_shared()
1163 		    ni->ni_macaddr, "shared key auth",  in hostap_auth_shared()
1169 	IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);  in hostap_auth_shared()
1176 	ieee80211_send_error(ni, wh->i_addr2,  in hostap_auth_shared()
1557 wpa_assocreq(struct ieee80211_node *ni, struct ieee80211_rsnparms *rsnparms,  in wpa_assocreq()  argument
1561 	struct ieee80211vap *vap = ni->ni_vap;  in wpa_assocreq()
1565 	ni->ni_flags &= ~(IEEE80211_NODE_WPS|IEEE80211_NODE_TSN);  in wpa_assocreq()
1573 			ni->ni_flags |= IEEE80211_NODE_WPS;  in wpa_assocreq()
1582 			ni->ni_flags |= IEEE80211_NODE_TSN;  in wpa_assocreq()
1625 	IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA, ni,  in wpa_assocreq()
1634 	ieee80211_node_deauth(ni, reason);  in wpa_assocreq()
1653 ieee80211_deliver_l2uf(struct ieee80211_node *ni)  in ieee80211_deliver_l2uf()  argument
1655 	struct ieee80211vap *vap = ni->ni_vap;  in ieee80211_deliver_l2uf()
1663 		IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,  in ieee80211_deliver_l2uf()
1673 	IEEE80211_ADDR_COPY(eh->ether_shost, ni->ni_macaddr);  in ieee80211_deliver_l2uf()
1684 	hostap_deliver_data(vap, ni, m);  in ieee80211_deliver_l2uf()
1688 ratesetmismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,  in ratesetmismatch()  argument
1691 	IEEE80211_NOTE_MAC(ni->ni_vap, IEEE80211_MSG_ANY, wh->i_addr2,  in ratesetmismatch()
1694 	IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_BASIC_RATE);  in ratesetmismatch()
1695 	ieee80211_node_leave(ni);  in ratesetmismatch()
1699 capinfomismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,  in capinfomismatch()  argument
1702 	struct ieee80211vap *vap = ni->ni_vap;  in capinfomismatch()
1707 	IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_CAPINFO);  in capinfomismatch()
1708 	ieee80211_node_leave(ni);  in capinfomismatch()
1713 htcapmismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,  in htcapmismatch()  argument
1716 	IEEE80211_NOTE_MAC(ni->ni_vap, IEEE80211_MSG_ANY, wh->i_addr2,  in htcapmismatch()
1719 	IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_MISSING_HT_CAPS);  in htcapmismatch()
1720 	ieee80211_node_leave(ni);  in htcapmismatch()
1724 authalgreject(struct ieee80211_node *ni, const struct ieee80211_frame *wh,  in authalgreject()  argument
1727 	struct ieee80211vap *vap = ni->ni_vap;  in authalgreject()
1732 	ieee80211_send_error(ni, wh->i_addr2, IEEE80211_FC0_SUBTYPE_AUTH,  in authalgreject()
1763 hostap_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,  in hostap_recv_mgmt()  argument
1766 	struct ieee80211vap *vap = ni->ni_vap;  in hostap_recv_mgmt()
1767 	struct ieee80211com *ic = ni->ni_ic;  in hostap_recv_mgmt()
1795 		if (ieee80211_parse_beacon(ni, m0, ic->ic_curchan, &scan) &~ IEEE80211_BPARSE_OFFCHAN)  in hostap_recv_mgmt()
1802 			IEEE80211_NODE_STAT(ni, rx_beacons);  in hostap_recv_mgmt()
1804 			IEEE80211_NODE_STAT(ni, rx_proberesp);  in hostap_recv_mgmt()
1980 			ieee80211_send_error(ni, wh->i_addr2,  in hostap_recv_mgmt()
1990 			ieee80211_send_error(ni, wh->i_addr2,  in hostap_recv_mgmt()
1996 			hostap_auth_shared(ni, wh, frm + 6, efrm, rssi, nf,  in hostap_recv_mgmt()
1999 			hostap_auth_open(ni, wh, rssi, nf, seq, status);  in hostap_recv_mgmt()
2001 			authalgreject(ni, wh, algo,  in hostap_recv_mgmt()
2014 			authalgreject(ni, wh, algo,  in hostap_recv_mgmt()
2043 		if (ni == vap->iv_bss) {  in hostap_recv_mgmt()
2047 			ieee80211_send_error(ni, wh->i_addr2,  in hostap_recv_mgmt()
2142 		    !wpa_assocreq(ni, &rsnparms, wh, wpa, rsn, capinfo))  in hostap_recv_mgmt()
2145 		if (ni->ni_challenge != NULL) {  in hostap_recv_mgmt()
2146 			IEEE80211_FREE(ni->ni_challenge, M_80211_NODE);  in hostap_recv_mgmt()
2147 			ni->ni_challenge = NULL;  in hostap_recv_mgmt()
2151 			capinfomismatch(ni, wh, reassoc, resp,  in hostap_recv_mgmt()
2158 		if (ni->ni_associd != 0 &&  in hostap_recv_mgmt()
2160 		    ((ni->ni_capinfo ^ capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME)) {  in hostap_recv_mgmt()
2161 			capinfomismatch(ni, wh, reassoc, resp,  in hostap_recv_mgmt()
2165 		rate = ieee80211_setup_rates(ni, rates, xrates,  in hostap_recv_mgmt()
2169 			ratesetmismatch(ni, wh, reassoc, resp, "legacy", rate);  in hostap_recv_mgmt()
2180 			ratesetmismatch(ni, wh, reassoc, resp, "11g", rate);  in hostap_recv_mgmt()
2188 		ni->ni_chan = vap->iv_bss->ni_chan;  in hostap_recv_mgmt()
2191 		if (IEEE80211_IS_CHAN_VHT(ni->ni_chan) &&  in hostap_recv_mgmt()
2196 			ieee80211_vht_node_init(ni);  in hostap_recv_mgmt()
2197 			ieee80211_vht_update_cap(ni, vhtcap, vhtinfo);  in hostap_recv_mgmt()
2198 		} else if (ni->ni_flags & IEEE80211_NODE_VHT)  in hostap_recv_mgmt()
2199 			ieee80211_vht_node_cleanup(ni);  in hostap_recv_mgmt()
2202 		if (IEEE80211_IS_CHAN_HT(ni->ni_chan) && htcap != NULL) {  in hostap_recv_mgmt()
2203 			rate = ieee80211_setup_htrates(ni, htcap,  in hostap_recv_mgmt()
2207 				ratesetmismatch(ni, wh, reassoc, resp,  in hostap_recv_mgmt()
2212 			ieee80211_ht_node_init(ni);  in hostap_recv_mgmt()
2213 			ieee80211_ht_updatehtcap(ni, htcap);  in hostap_recv_mgmt()
2214 		} else if (ni->ni_flags & IEEE80211_NODE_HT)  in hostap_recv_mgmt()
2215 			ieee80211_ht_node_cleanup(ni);  in hostap_recv_mgmt()
2218 		if (IEEE80211_IS_CHAN_HT(ni->ni_chan) && htcap != NULL) {  in hostap_recv_mgmt()
2219 			ieee80211_ht_updatehtcap_final(ni);  in hostap_recv_mgmt()
2224 		ieee80211_ff_node_cleanup(ni);  in hostap_recv_mgmt()
2232 		if ((ni->ni_flags & IEEE80211_NODE_HT) &&  in hostap_recv_mgmt()
2237 			    IEEE80211_MSG_ASSOC | IEEE80211_MSG_11N, ni,  in hostap_recv_mgmt()
2241 			ieee80211_ht_node_cleanup(ni);  in hostap_recv_mgmt()
2244 			ieee80211_ff_node_cleanup(ni);  in hostap_recv_mgmt()
2252 		    (ni->ni_flags & IEEE80211_NODE_HT) == 0) {  in hostap_recv_mgmt()
2253 			htcapmismatch(ni, wh, reassoc, resp);  in hostap_recv_mgmt()
2257 		IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);  in hostap_recv_mgmt()
2258 		ni->ni_noise = nf;  in hostap_recv_mgmt()
2259 		ni->ni_intval = lintval;  in hostap_recv_mgmt()
2260 		ni->ni_capinfo = capinfo;  in hostap_recv_mgmt()
2261 		ni->ni_fhdwell = vap->iv_bss->ni_fhdwell;  in hostap_recv_mgmt()
2262 		ni->ni_fhindex = vap->iv_bss->ni_fhindex;  in hostap_recv_mgmt()
2267 		if (ieee80211_ies_init(&ni->ni_ies, sfrm, efrm - sfrm)) {  in hostap_recv_mgmt()
2268 #define	setie(_ie, _off)	ieee80211_ies_setie(ni->ni_ies, _ie, _off)  in hostap_recv_mgmt()
2280 				ni->ni_flags |= IEEE80211_NODE_QOS;  in hostap_recv_mgmt()
2281 				if (ieee80211_parse_wmeie(wme, wh, ni) > 0) {  in hostap_recv_mgmt()
2282 					if (ni->ni_uapsd != 0)  in hostap_recv_mgmt()
2283 						ni->ni_flags |=  in hostap_recv_mgmt()
2286 						ni->ni_flags &=  in hostap_recv_mgmt()
2290 				ni->ni_flags &=  in hostap_recv_mgmt()
2299 				ieee80211_parse_ath(ni, ni->ni_ies.ath_ie);  in hostap_recv_mgmt()
2302 				ni->ni_ath_flags = 0;  in hostap_recv_mgmt()
2305 			ni->ni_flags &= ~IEEE80211_NODE_QOS;  in hostap_recv_mgmt()
2306 			ni->ni_flags &= ~IEEE80211_NODE_UAPSD;  in hostap_recv_mgmt()
2307 			ni->ni_ath_flags = 0;  in hostap_recv_mgmt()
2309 		ieee80211_node_join(ni, resp);  in hostap_recv_mgmt()
2310 		ieee80211_deliver_l2uf(ni);  in hostap_recv_mgmt()
2336 			IEEE80211_NODE_STAT(ni, rx_deauth);  in hostap_recv_mgmt()
2339 			IEEE80211_NODE_STAT(ni, rx_disassoc);  in hostap_recv_mgmt()
2341 		IEEE80211_NOTE(vap, IEEE80211_MSG_AUTH, ni,  in hostap_recv_mgmt()
2345 		if (ni != vap->iv_bss)  in hostap_recv_mgmt()
2346 			ieee80211_node_leave(ni);  in hostap_recv_mgmt()
2352 		if (ni == vap->iv_bss) {  in hostap_recv_mgmt()
2367 			if (ieee80211_parse_action(ni, m0) == 0)  in hostap_recv_mgmt()
2368 				(void)ic->ic_recv_action(ni, wh, frm, efrm);  in hostap_recv_mgmt()
2390 hostap_recv_ctl(struct ieee80211_node *ni, struct mbuf *m, int subtype)  in hostap_recv_ctl()  argument
2394 		ni->ni_vap->iv_recv_pspoll(ni, m);  in hostap_recv_ctl()
2397 		ieee80211_recv_bar(ni, m);  in hostap_recv_ctl()
2406 ieee80211_recv_pspoll(struct ieee80211_node *ni, struct mbuf *m0)  in ieee80211_recv_pspoll()  argument
2408 	struct ieee80211vap *vap = ni->ni_vap;  in ieee80211_recv_pspoll()
2416 	if (ni->ni_associd == 0) {  in ieee80211_recv_pspoll()
2422 		IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_DEAUTH,  in ieee80211_recv_pspoll()
2428 	if (aid != ni->ni_associd) {  in ieee80211_recv_pspoll()
2433 		    ni->ni_associd, aid);  in ieee80211_recv_pspoll()
2447 	m = ieee80211_node_psq_dequeue(ni, &qlen);  in ieee80211_recv_pspoll()
2451 		ieee80211_send_nulldata(ieee80211_ref_node(ni));  in ieee80211_recv_pspoll()
2454 			vap->iv_set_tim(ni, 0);	/* just in case */  in ieee80211_recv_pspoll()
2463 		IEEE80211_NOTE(vap, IEEE80211_MSG_POWER, ni,  in ieee80211_recv_pspoll()
2467 		IEEE80211_NOTE(vap, IEEE80211_MSG_POWER, ni,  in ieee80211_recv_pspoll()
2470 			vap->iv_set_tim(ni, 0);  in ieee80211_recv_pspoll()