diff -urN madwifi-ng-r2377-20070526.old/ath/if_ath.c madwifi-ng-r2377-20070526.dev/ath/if_ath.c
--- madwifi-ng-r2377-20070526.old/ath/if_ath.c	2007-05-26 18:51:08.569784736 +0200
+++ madwifi-ng-r2377-20070526.dev/ath/if_ath.c	2007-05-26 18:51:08.661770752 +0200
@@ -5672,7 +5672,8 @@
 		 * frame; it'll be dropped where it's not wanted.
 		 */
 		if (rs->rs_keyix != HAL_RXKEYIX_INVALID &&
-		    (ni = sc->sc_keyixmap[rs->rs_keyix]) != NULL) {
+		    ((ni = sc->sc_keyixmap[rs->rs_keyix]) != NULL) &&
+			ieee80211_check_rxnode(ni, (const struct ieee80211_frame_min *) skb->data)) {
 			struct ath_node *an;
 			/*
 			 * Fast path: node is present in the key map;
diff -urN madwifi-ng-r2377-20070526.old/net80211/ieee80211_node.c madwifi-ng-r2377-20070526.dev/net80211/ieee80211_node.c
--- madwifi-ng-r2377-20070526.old/net80211/ieee80211_node.c	2007-05-21 17:53:39.000000000 +0200
+++ madwifi-ng-r2377-20070526.dev/net80211/ieee80211_node.c	2007-05-26 18:51:08.663770448 +0200
@@ -1269,8 +1269,6 @@
 	IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
 
 	return ni;
-#undef IS_PSPOLL
-#undef IS_CTL
 }
 #ifdef IEEE80211_DEBUG_REFCNT
 EXPORT_SYMBOL(ieee80211_find_rxnode_debug);
@@ -1278,6 +1276,20 @@
 EXPORT_SYMBOL(ieee80211_find_rxnode);
 #endif
 
+int
+ieee80211_check_rxnode(struct ieee80211_node *ni,
+	const struct ieee80211_frame_min *wh)
+{
+	if (IS_CTL(wh) && !IS_PSPOLL(wh) /*&& !IS_RTS(ah)*/)
+		return IEEE80211_ADDR_EQ(ni->ni_macaddr, wh->i_addr1);
+	else
+		return IEEE80211_ADDR_EQ(ni->ni_macaddr, wh->i_addr2);
+}
+
+EXPORT_SYMBOL(ieee80211_check_rxnode);
+#undef IS_PSPOLL
+#undef IS_CTL
+
 /*
  * Return a reference to the appropriate node for sending
  * a data frame.  This handles node discovery in adhoc networks.
diff -urN madwifi-ng-r2377-20070526.old/net80211/ieee80211_node.h madwifi-ng-r2377-20070526.dev/net80211/ieee80211_node.h
--- madwifi-ng-r2377-20070526.old/net80211/ieee80211_node.h	2007-05-21 17:53:39.000000000 +0200
+++ madwifi-ng-r2377-20070526.dev/net80211/ieee80211_node.h	2007-05-26 18:51:08.664770296 +0200
@@ -323,6 +323,8 @@
 	*pni = NULL;			/* guard against use */
 }
 
+int ieee80211_check_rxnode(struct ieee80211_node *ni,
+	const struct ieee80211_frame_min *wh);
 int ieee80211_add_wds_addr(struct ieee80211_node_table *, struct ieee80211_node *,
 	const u_int8_t *, u_int8_t);
 void ieee80211_remove_wds_addr(struct ieee80211_node_table *, const u_int8_t *);