Hi, > @@ -297,7 +297,8 @@ ieee80211_tx_h_check_assoc(struct ieee80 > if (unlikely(test_bit(SCAN_SW_SCANNING, &tx->local->scanning)) && > test_bit(SDATA_STATE_OFFCHANNEL, &tx->sdata->state) && > !ieee80211_is_probe_req(hdr->frame_control) && > - !ieee80211_is_nullfunc(hdr->frame_control)) > + !ieee80211_is_nullfunc(hdr->frame_control) && > + !ieee80211_is_qos_nullfunc(hdr->frame_control)) > /* > * When software scanning only nullfunc frames (to notify > * the sleep state to the AP) and probe requests (for the yeah, Thomas also found it, we now have this in the tree: if (unlikely(test_bit(SCAN_SW_SCANNING, &tx->local->scanning)) && test_bit(SDATA_STATE_OFFCHANNEL, &tx->sdata->state) && !ieee80211_is_probe_req(hdr->frame_control) && !ieee80211_is_any_nullfunc(hdr->frame_control)) johannes