On Sun, 2008-08-31 at 10:05 +0200, Eric wrote:

When analyzing the actual responses (tcpdumping on the mon.wlan0 iface, 
using wireshark to disect), I discovered that the probe responses for a 
SSID broadcast
had the WEP bit and the Fragmentation bit set, consistently, for all 
probe responses.

You were looking at the wrong bit, the radiotap bit, which has little to
do with what gets actually sent.

johannes