diff --git a/net-wireless/madwifi-ng/files/madwifi-2.6.22.patch b/net-wireless/madwifi-ng/files/madwifi-2.6.22.patch
new file mode 100644
--- /dev/null
+++ b/net-wireless/madwifi-ng/files/madwifi-2.6.22.patch
@@ -0,0 +1,105 @@
+--- madwifi-0.9.3.1/ath/if_ath_pci.c.orig	2007-07-10 01:01:07.000000000 -0700
++++ madwifi-0.9.3.1/ath/if_ath_pci.c	2007-07-10 01:01:54.000000000 -0700
+@@ -207,7 +207,7 @@
+ 
+ 	pci_set_drvdata(pdev, dev);
+ 
+-	if (request_irq(dev->irq, ath_intr, SA_SHIRQ, dev->name, dev)) {
++	if (request_irq(dev->irq, ath_intr, IRQF_SHARED, dev->name, dev)) {
+ 		printk(KERN_WARNING "%s: request_irq failed\n", dev->name);
+ 		goto bad3;
+ 	}
+--- madwifi-0.9.3.1/net80211/ieee80211_input.c.orig	2007-07-10 00:51:24.000000000 -0700
++++ madwifi-0.9.3.1/net80211/ieee80211_input.c	2007-07-10 00:51:29.000000000 -0700
+@@ -1048,11 +1048,11 @@
+ 			 * incoming fragments
+ 			 * XXX 4-address/QoS frames?
+ 			 */
+-			else if (skb->end - skb->head < ni->ni_vap->iv_dev->mtu +
++			else if (skb_end_pointer(skb) - skb->head < ni->ni_vap->iv_dev->mtu +
+ 				 hdrlen) {
+ 				ni->ni_rxfrag = skb_copy_expand(skb, 0,
+ 					(ni->ni_vap->iv_dev->mtu + hdrlen) -
+-					(skb->end - skb->head), GFP_ATOMIC);
++					(skb_end_pointer(skb) - skb->head), GFP_ATOMIC);
+ 				dev_kfree_skb(skb);
+ 			}
+ 		}
+@@ -1066,7 +1066,7 @@
+ 			 * we've verified that before
+ 			 */
+ 			/* Copy current fragment at end of previous one */
+-			memcpy(ni->ni_rxfrag->tail,
++			memcpy(skb_tail_pointer(ni->ni_rxfrag),
+ 			       skb->data + hdrlen, skb->len - hdrlen);
+ 			/* Update tail and length */
+ 			skb_put(ni->ni_rxfrag, skb->len - hdrlen);
+@@ -1136,8 +1136,8 @@
+ 		}
+ 		if (skb1 != NULL) {
+ 			skb1->dev = dev;
+-			skb1->mac.raw = skb1->data;
+-			skb1->nh.raw = skb1->data + sizeof(struct ether_header);
++			skb_reset_mac_header(skb1);
++			skb_set_network_header(skb1, sizeof(struct ether_header));
+ 			skb1->protocol = __constant_htons(ETH_P_802_2);
+ 			/* XXX insert vlan tag before queue it? */
+ 			dev_queue_xmit(skb1);
+@@ -2259,7 +2259,7 @@
+ 		if (skb1 == NULL)
+ 			return;
+ 		skb1->dev = dev;
+-		skb1->mac.raw = skb1->data;
++		skb_reset_mac_header(skb1);
+ 		skb1->ip_summed = CHECKSUM_NONE;
+ 		skb1->pkt_type = PACKET_OTHERHOST;
+ 		skb1->protocol = __constant_htons(0x0019);  /* ETH_P_80211_RAW */
+@@ -2533,8 +2533,9 @@
+ 	l2uf->xid[2] = 0x00;
+ 	
+ 	skb->dev = dev;
+-	skb->protocol = eth_type_trans(skb, dev);
+-	skb->mac.raw = skb->data;
++	skb->pkt_type = PACKET_BROADCAST;
++	skb->protocol = htons(ETH_P_802_2);
++	skb_reset_mac_header(skb);
+ 	ieee80211_deliver_data(ni, skb);
+ 	return;
+ }
+@@ -3713,14 +3714,14 @@
+ {
+ 	struct ethhdr *eth;
+ 	
+-	skb->mac.raw=skb->data;
++	skb_reset_mac_header(skb);
+ 	skb_pull(skb, ETH_HLEN);
+ 	/*
+ 	 * NB: mac.ethernet is replaced in 2.6.9 by eth_hdr but
+ 	 *     since that's an inline and not a define there's
+ 	 *     no easy way to do this cleanly.
+ 	 */
+-	eth = (struct ethhdr *)skb->mac.raw;
++	eth = (struct ethhdr *)skb_mac_header(skb);
+ 	
+ 	if (*eth->h_dest & 1)
+ 		if (memcmp(eth->h_dest, dev->broadcast, ETH_ALEN) == 0)
+--- madwifi-0.9.3.1/net80211/ieee80211_monitor.c.orig	2007-07-10 00:52:51.000000000 -0700
++++ madwifi-0.9.3.1/net80211/ieee80211_monitor.c	2007-07-10 00:54:29.000000000 -0700
+@@ -373,7 +373,7 @@
+ 		if (vap->iv_monitor_txf_len && tx) {
+ 			/* truncate transmit feedback packets */
+ 			skb_trim(skb1, vap->iv_monitor_txf_len);
+-			skb1->nh.raw = skb1->data;
++			skb_reset_network_header(skb1);
+ 		}
+ 		switch (vap->iv_dev->type) {
+ 		case ARPHRD_IEEE80211:
+@@ -555,7 +555,7 @@
+ 				skb_trim(skb1, skb1->len - IEEE80211_CRC_LEN);
+ 			}
+ 			skb1->dev = dev; /* NB: deliver to wlanX */
+-			skb1->mac.raw = skb1->data;
++			skb_reset_mac_header(skb1);
+ 			skb1->ip_summed = CHECKSUM_NONE;
+ 			skb1->pkt_type = pkttype;
+ 			skb1->protocol = __constant_htons(0x0019); /* ETH_P_80211_RAW */