It appears that when the NG driver is in adhoc mode, any station attempting to associate and is "IBSS capable" will be added to the association list (wlanconfig ath0 list) even though the  may not actually be in adhoc mode.

The test case goes like this. My system is in adhoc mode, SSID set as "rick_network", B-mode, channel 6, no WEP etc, ACL white list with one MAC allowed (01:02:03:04:05:06). A node is created for MAC (01:02:03:04:05:06) and is shown in wlanconfig ath0 list. Now, another machine (MAC 11:12:13:14:15:16) is turned on and is IBSS "capable", the MAC is not in the white list. Madwifi allows the "association" when a Beacon/Probe Response is received, and the node is added to the "list" (wlanconfig ath0 list now shows both MACs)

Specifically, in ieee_80211_input.c when a Beacon/Probe Response is received, the code allows a node to be added and does so with by calleing ieee_80211_add_neighbor() route.

if (scan.capinfo & IEEE80211_CAP_INFO_IBSS) {
  if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni-ni_macaddr) {
    ni = ieee80211_add_neighbor(...)

Why was this routine called rather than using the ieee80211_fakeup_adhoc_node() routine that is used elsewhere in the driver? And shouldn't there be a check of the ACL somewhere, or did I miss it?

We're using the NG driver (R1637).