diff --git a/kernel-src/io/net/netdev.c b/kernel-src/io/net/netdev.c
index 1fcc1fa3..44b7858f 100644
--- a/kernel-src/io/net/netdev.c
+++ b/kernel-src/io/net/netdev.c
@@ -57,6 +57,10 @@ typedef struct {
 
 int handle_wlan_ioctl(netdev_t *netdev, unsigned long request, void *arg, int *result, cred_t *cred) {
 	// TODO: make every operation besides get bss cache be privileged
+
+	if ((netdev->flags & NETDEV_FLAGS_WLAN) == 0)
+		return EINVAL;
+	
 	switch (request) {
 		case NETDEV_IOCTL_WLAN_SCAN:
 			return wlan_active_scan(netdev);
@@ -71,7 +75,10 @@ int handle_wlan_ioctl(netdev_t *netdev, unsigned long request, void *arg, int *r
 			if (IS_USER_ADDRESS(arg) && !IS_USER_ADDRESS(bss_request.buffer))
 				return EFAULT;
 
-			wlan_get_bss_cache(netdev, bss_request.buffer, bss_request.buffer_size, &bss_request.records_returned);
+			error = wlan_get_bss_cache(netdev, bss_request.buffer, bss_request.buffer_size, &bss_request.records_returned);
+			if (error)
+				return error;
+
 			return USERCOPY_POSSIBLY_TO_USER(arg, &bss_request, sizeof(bss_request));
 		}
 		case NETDEV_IOCTL_WLAN_ASSOCIATE: {
@@ -240,6 +247,7 @@ static devops_t devops = {
 };
 
 int netdev_register(netdev_t *netdev, char *name) {
+	// TODO: better allocation strategy (copy wlan's?)
 	int minor = __atomic_fetch_add(&current_minor, 1, __ATOMIC_RELAXED);
 	MUTEX_ACQUIRE(&tablelock);
 	int e = hashtable_set(&nametable, netdev, name, strlen(name), true);
diff --git a/kernel-src/io/net/wlan.c b/kernel-src/io/net/wlan.c
index 353f5f0a..f2ee28cc 100644
--- a/kernel-src/io/net/wlan.c
+++ b/kernel-src/io/net/wlan.c
@@ -38,7 +38,7 @@ static int allocate_id(void) {
 		if (snapshot == UINT64_MAX)
 			return -1;
 
-		int id = __builtin_ctz(~snapshot);
+		int id = __builtin_ctzll(~snapshot);
 		uint64_t mask = 1lu << id;
 		if (__atomic_fetch_or(&id_bitmap, mask, __ATOMIC_RELAXED) & mask)
 			continue;
@@ -160,7 +160,8 @@ static int wlan_alloc_desc(netdev_t *netdev, size_t requested_size, netdesc_t *d
 		return EINVAL;
 
 	desc->address = u80211_desc.data;
-	desc->curroffset = u80211_desc.current_offset;
+	// the network stack writes forward from curroffset. u80211 builds backward from the end.
+	desc->curroffset = u80211_desc.current_offset - requested_size;
 	desc->size = u80211_desc.size;
 	return 0;
 }
@@ -173,7 +174,8 @@ static int wlan_free_desc(netdev_t *netdev, netdesc_t *desc) {
 static int wlan_send_packet(netdev_t *netdev, netdesc_t desc, mac_t target, int proto) {
 	wlan_device_t *wlan = (wlan_device_t *)netdev;
 
-	ethframe_t *ethframe = desc.address;
+	desc.curroffset -= sizeof(ethframe_t);
+	ethframe_t *ethframe = (void *)((uintptr_t)desc.address + desc.curroffset);
 	ethframe->type = cpu_to_be_w(proto);
 	memcpy(&ethframe->source, &wlan->netdev.mac, sizeof(mac_t));
 	memcpy(&ethframe->destination, &target, sizeof(mac_t));