Index: sys/net80211/ieee80211_ioctl.c
===================================================================
--- sys/net80211/ieee80211_ioctl.c
+++ sys/net80211/ieee80211_ioctl.c
@@ -863,18 +863,7 @@
 		ireq->i_val = vap->iv_protmode;
 		break;
 	case IEEE80211_IOC_TXPOWER:
-		/*
-		 * Tx power limit is the min of max regulatory
-		 * power, any user-set limit, and the max the
-		 * radio can do.
-		 *
-		 * TODO: methodize this
-		 */
-		ireq->i_val = 2*ic->ic_curchan->ic_maxregpower;
-		if (ireq->i_val > ic->ic_txpowlimit)
-			ireq->i_val = ic->ic_txpowlimit;
-		if (ireq->i_val > ic->ic_curchan->ic_maxpower)
-			ireq->i_val = ic->ic_curchan->ic_maxpower;
+		ieee80211_get_channel_txpower(ireq, ic);
 		break;
 	case IEEE80211_IOC_WPA:
 		switch (vap->iv_flags & IEEE80211_F_WPA) {
Index: sys/net80211/ieee80211_var.h
===================================================================
--- sys/net80211/ieee80211_var.h
+++ sys/net80211/ieee80211_var.h
@@ -956,6 +956,28 @@
 }
 
 /*
+ * Fetch the current TX power (cap) for the given channel.
+ *
+ * This includes the node and ic/vap TX power limit as needed,
+ * but it doesn't take into account any per-rate limit.
+ */
+static __inline void
+ieee80211_get_channel_txpower(struct ieee80211req *ireq,
+    struct ieee80211com *ic)
+{
+	/*
+	 * Tx power limit is the min of max regulatory
+	 * power, any user-set limit, and the max the
+	 * radio can do.
+	 */
+	ireq->i_val = 2 * ic->ic_curchan->ic_maxregpower;
+	if (ireq->i_val > ic->ic_txpowlimit)
+		ireq->i_val = ic->ic_txpowlimit;
+	if (ireq->i_val > ic->ic_curchan->ic_maxpower)
+		ireq->i_val = ic->ic_curchan->ic_maxpower;
+}
+
+/*
  * Debugging facilities compiled in when IEEE80211_DEBUG is defined.
  *
  * The intent is that any problem in the net80211 layer can be