I am working on another AR9170 project. 
This essentially requires injecting broadcast packets of specific size,
frequency, ... at extremely precise intervals.

I am trying to understand the data flow in the firmware. 

Initially I was looking to generate the frames in the firmware. 
The payload is simple. Though I am pondering the wisdom of that right
now. Regardless, I will have to control my frames in firmware, so I need
to separate them from normal traffic and then feed them into the Radio
Queues at the appropriate times. 

Am I correct that the same struct dma_desc is being used by both USB and
the Radio ?

Each dma_desc points to a payload, for tx packets this is a  struct
carl9170_tx_superframe, which must also be what the skb pointed to by 
void carl9170_usb_tx(struct ar9170 *ar, struct sk_buff *skb) is
sending ?

Can I construct a carl9170_tx_superframe on the host side, with
something to allow me to identify it in handle_download in the firmware,
perform minor mangling of the contents, and repeatedly transmit it at
fixed intervals using wlan_tx() ?