diff -ur madwifi.old/ath/if_ath.c madwifi.dev/ath/if_ath.c
--- madwifi.old/ath/if_ath.c	2007-05-21 07:33:42.392925296 +0200
+++ madwifi.dev/ath/if_ath.c	2007-05-21 07:35:51.933232176 +0200
@@ -5660,7 +5660,8 @@
 		 * frame; it'll be dropped where it's not wanted.
 		 */
 		if (rs->rs_keyix != HAL_RXKEYIX_INVALID &&
-		    (ni = sc->sc_keyixmap[rs->rs_keyix]) != NULL) {
+		    ((ni = sc->sc_keyixmap[rs->rs_keyix]) != NULL) &&
+			ieee80211_check_rxnode(ni, (const struct ieee80211_frame_min *) skb->data)) {
 			struct ath_node *an;
 			/*
 			 * Fast path: node is present in the key map;
diff -ur madwifi.old/net80211/ieee80211_node.c madwifi.dev/net80211/ieee80211_node.c
--- madwifi.old/net80211/ieee80211_node.c	2007-05-21 07:33:42.371928488 +0200
+++ madwifi.dev/net80211/ieee80211_node.c	2007-05-21 07:34:13.689167544 +0200
@@ -1272,8 +1272,6 @@
 	IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
 
 	return ni;
-#undef IS_PSPOLL
-#undef IS_CTL
 }
 #ifdef IEEE80211_DEBUG_REFCNT
 EXPORT_SYMBOL(ieee80211_find_rxnode_debug);
@@ -1281,6 +1279,20 @@
 EXPORT_SYMBOL(ieee80211_find_rxnode);
 #endif
 
+int
+ieee80211_check_rxnode(struct ieee80211_node *ni,
+	const struct ieee80211_frame_min *wh)
+{
+	if (IS_CTL(wh) && !IS_PSPOLL(wh) /*&& !IS_RTS(ah)*/)
+		return IEEE80211_ADDR_EQ(ni->ni_macaddr, wh->i_addr1);
+	else
+		return IEEE80211_ADDR_EQ(ni->ni_macaddr, wh->i_addr2);
+}
+
+EXPORT_SYMBOL(ieee80211_check_rxnode);
+#undef IS_PSPOLL
+#undef IS_CTL
+
 /*
  * Return a reference to the appropriate node for sending
  * a data frame.  This handles node discovery in adhoc networks.
diff -ur madwifi.old/net80211/ieee80211_node.h madwifi.dev/net80211/ieee80211_node.h
--- madwifi.old/net80211/ieee80211_node.h	2007-05-21 07:33:42.372928336 +0200
+++ madwifi.dev/net80211/ieee80211_node.h	2007-05-21 07:34:13.689167544 +0200
@@ -317,6 +317,8 @@
 	*pni = NULL;			/* guard against use */
 }
 
+int ieee80211_check_rxnode(struct ieee80211_node *ni,
+	const struct ieee80211_frame_min *wh);
 int ieee80211_add_wds_addr(struct ieee80211_node_table *, struct ieee80211_node *,
 	const u_int8_t *, u_int8_t);
 void ieee80211_remove_wds_addr(struct ieee80211_node_table *, const u_int8_t *);