Index: sys/dev/iwn/if_iwn.c
===================================================================
--- sys/dev/iwn/if_iwn.c
+++ sys/dev/iwn/if_iwn.c
@@ -4450,7 +4450,7 @@
 	/*
 	 * 11bg protection not enabled? Then don't use it.
 	 */
-	if ((ic->ic_flags & IEEE80211_F_USEPROT) == 0)
+	if ((vap->iv_flags & IEEE80211_F_USEPROT) == 0)
 		return (0);
 
 	/*
@@ -4936,7 +4936,7 @@
 	data->ni = ni;
 
 	DPRINTF(sc, IWN_DEBUG_XMIT, "%s: qid %d idx %d len %d nsegs %d "
-	    "plcp %d\n",
+	    "plcp 0x%x\n",
 	    __func__, ring->qid, ring->cur, totlen, nsegs, tx->rate);
 
 	/* Fill TX descriptor. */
@@ -6654,18 +6654,18 @@
 }
 
 static uint32_t
-iwn_get_rxon_ht_flags(struct iwn_softc *sc, struct ieee80211_channel *c)
+iwn_get_rxon_ht_flags(struct iwn_softc *sc, struct ieee80211vap *vap,
+    struct ieee80211_channel *c)
 {
-	struct ieee80211com *ic = &sc->sc_ic;
 	uint32_t htflags = 0;
 
 	if (! IEEE80211_IS_CHAN_HT(c))
 		return (0);
 
-	htflags |= IWN_RXON_HT_PROTMODE(ic->ic_curhtprotmode);
+	htflags |= IWN_RXON_HT_PROTMODE(vap->iv_curhtprotmode);
 
 	if (IEEE80211_IS_CHAN_HT40(c)) {
-		switch (ic->ic_curhtprotmode) {
+		switch (vap->iv_curhtprotmode) {
 		case IEEE80211_HTINFO_OPMODE_HT20PR:
 			htflags |= IWN_RXON_HT_MODEPURE40;
 			break;
@@ -6912,7 +6912,7 @@
 	    sc->rxchainmask,
 	    sc->nrxchains);
 
-	sc->rxon->flags |= htole32(iwn_get_rxon_ht_flags(sc, ic->ic_curchan));
+	sc->rxon->flags |= htole32(iwn_get_rxon_ht_flags(sc, vap, ic->ic_curchan));
 
 	DPRINTF(sc, IWN_DEBUG_RESET,
 	    "%s: setting configuration; flags=0x%08x\n",
@@ -7285,9 +7285,17 @@
 	sc->rxon->flags = htole32(IWN_RXON_TSF | IWN_RXON_CTS_TO_SELF);
 	if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
 		sc->rxon->flags |= htole32(IWN_RXON_AUTO | IWN_RXON_24GHZ);
-	if (ic->ic_flags & IEEE80211_F_SHSLOT)
+
+	/*
+	 * We always set short slot on 5GHz channels.
+	 * We optionally set it for 2.4GHz channels.
+	 */
+	if (IEEE80211_IS_CHAN_5GHZ(ni->ni_chan))
+		sc->rxon->flags |= htole32(IWN_RXON_SHSLOT);
+	else if (vap->iv_flags & IEEE80211_F_SHSLOT)
 		sc->rxon->flags |= htole32(IWN_RXON_SHSLOT);
-	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
+
+	if (vap->iv_flags & IEEE80211_F_SHPREAMBLE)
 		sc->rxon->flags |= htole32(IWN_RXON_SHPREAMBLE);
 	if (IEEE80211_IS_CHAN_A(ni->ni_chan)) {
 		sc->rxon->cck_mask  = 0;
@@ -7302,7 +7310,7 @@
 	}
 
 	/* try HT */
-	sc->rxon->flags |= htole32(iwn_get_rxon_ht_flags(sc, ic->ic_curchan));
+	sc->rxon->flags |= htole32(iwn_get_rxon_ht_flags(sc, vap, ic->ic_curchan));
 
 	DPRINTF(sc, IWN_DEBUG_STATE, "rxon chan %d flags %x cck %x ofdm %x\n",
 	    sc->rxon->chan, sc->rxon->flags, sc->rxon->cck_mask,
@@ -7349,9 +7357,14 @@
 	sc->rxon->flags = htole32(IWN_RXON_TSF | IWN_RXON_CTS_TO_SELF);
 	if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
 		sc->rxon->flags |= htole32(IWN_RXON_AUTO | IWN_RXON_24GHZ);
-	if (ic->ic_flags & IEEE80211_F_SHSLOT)
+
+	/* As previously - short slot only on 5GHz */
+	if (IEEE80211_IS_CHAN_5GHZ(ni->ni_chan))
 		sc->rxon->flags |= htole32(IWN_RXON_SHSLOT);
-	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
+	else if (vap->iv_flags & IEEE80211_F_SHSLOT)
+		sc->rxon->flags |= htole32(IWN_RXON_SHSLOT);
+
+	if (vap->iv_flags & IEEE80211_F_SHPREAMBLE)
 		sc->rxon->flags |= htole32(IWN_RXON_SHPREAMBLE);
 	if (IEEE80211_IS_CHAN_A(ni->ni_chan)) {
 		sc->rxon->cck_mask  = 0;
@@ -7365,10 +7378,10 @@
 		sc->rxon->ofdm_mask = 0x15;
 	}
 	/* try HT */
-	sc->rxon->flags |= htole32(iwn_get_rxon_ht_flags(sc, ni->ni_chan));
+	sc->rxon->flags |= htole32(iwn_get_rxon_ht_flags(sc, vap, ni->ni_chan));
 	sc->rxon->filter |= htole32(IWN_FILTER_BSS);
 	DPRINTF(sc, IWN_DEBUG_STATE, "rxon chan %d flags %x, curhtprotmode=%d\n",
-	    sc->rxon->chan, le32toh(sc->rxon->flags), ic->ic_curhtprotmode);
+	    sc->rxon->chan, le32toh(sc->rxon->flags), vap->iv_curhtprotmode);
 
 	if ((error = iwn_send_rxon(sc, 0, 1)) != 0) {
 		device_printf(sc->sc_dev, "%s: could not send RXON\n",