>Here is the way it works.
>I add to wi(4) two subroutine to tap frames. One takes an mbuf chain
>containing an 802.11 mgmt/ctrl frame w/ hardware-specific extensions,
>and hands up either an 802.11 frame, an 802.11 frame w/ extensions,
>both, or neither:
>
>STATIC void
>wi_tap_802_11_plus(struct wi_softc *sc, struct mbuf *m,
>                   struct wi_frame *hwframe)
>{
>        struct mbuf *m2;
>
>        if (sc->sc_bpf80211plus) {
>                bpf_mtap((caddr_t) sc->sc_bpf80211plus, m);
>        }
>        if (sc->sc_bpf80211) {
>
>                m2 = m_copym(m, WI_802_11_OFFSET_HDR, M_COPYALL, M_DONTWAIT);
>                if (m2) {
>                        bpf_mtap((caddr_t) sc->sc_bpf80211, m);
>                        m_freem(m2);
>                }
>        }
>}

	do you really need a m_copym()?  see what sys/net/if_loop.c does
	to prepend extra item on bpf_mtap().

itojun