Index: wpa_supplicant-0.6.6/wpa_supplicant/wpa_supplicant.c
===================================================================
--- wpa_supplicant-0.6.6.orig/wpa_supplicant/wpa_supplicant.c	2008-07-24 16:28:58.000000000 +0200
+++ wpa_supplicant-0.6.6/wpa_supplicant/wpa_supplicant.c	2008-07-24 16:47:40.000000000 +0200
@@ -1206,7 +1206,7 @@
 {
 #define SCAN_AP_LIMIT 128
 	struct wpa_scan_result *results;
-	int num, i;
+	int num, i, j;
 	struct wpa_scan_results *res;
 
 	results = os_malloc(SCAN_AP_LIMIT * sizeof(struct wpa_scan_result));
@@ -1303,6 +1303,21 @@
 		res->res[res->num++] = r;
 	}
 
+	/* sort scan results by quality */
+	for(i = 0; i < num - 1; i++) {
+		for(j = i + 1; j < num; j++) {
+			struct wpa_scan_result tmp;
+
+			if (results[i].qual > results[j].qual)
+				continue;
+
+			os_memcpy(&tmp, &results[i], sizeof(tmp));
+			os_memcpy(&results[i], &results[j], sizeof(tmp));
+			os_memcpy(&results[j], &tmp, sizeof(tmp));
+		}
+	}
+
+
 	os_free(results);
 	wpa_s->scan_res = res;