13:26 < nbd> let me describe what i think is happening
13:26 < nbd> throughout the stack the calling convention is used that if a node isn't found, ni is set to vap->iv_bss
13:26 < nbd> when receiving management frames however, it checks if a node is new or not before adding it to the list
13:27 < nbd> but it did not check for ni == vap->iv_bss
13:27 < nbd> but it compared the ni macaddr against wh->wh_addr2
13:27 < nbd> now most of the time wh->wh_addr2 does contain the mac address of the node
13:27 < nbd> but that doesn't hold true for pspoll or control frames