+			if (tmp_old[0] == WLAN_EID_VENDOR_SPECIFIC) {
+				if (!memcmp(tmp_old + 2, tmp + 2, 5)) {
+					/* same vendor ie, copy from new ie */
+					memcpy(pos, tmp, tmp[1] + 2);
+					pos += tmp[1] + 2;
+				} else {
+					memcpy(pos, tmp_old, tmp_old[1] + 2);
+					pos += tmp_old[1] + 2;

This seems really strange. What's 5? Should it be 4, so you have
OUI+subelement ID?

johannes