diff --git a/package/mac80211/patches/525-ath9k_handle_keymiss.patch b/package/mac80211/patches/525-ath9k_handle_keymiss.patch
index a2031cf468..bbdd177615 100644
--- a/package/mac80211/patches/525-ath9k_handle_keymiss.patch
+++ b/package/mac80211/patches/525-ath9k_handle_keymiss.patch
@@ -1,23 +1,23 @@
 --- a/drivers/net/wireless/ath/ath9k/mac.c
 +++ b/drivers/net/wireless/ath/ath9k/mac.c
-@@ -701,6 +701,8 @@ int ath9k_hw_rxprocdesc(struct ath_hw *a
- 		rs->rs_flags |= ATH9K_RX_DELIM_CRC_POST;
- 	if (ads.ds_rxstatus8 & AR_DecryptBusyErr)
- 		rs->rs_flags |= ATH9K_RX_DECRYPT_BUSY;
-+	if (ads.ds_rxstatus8 & AR_KeyMiss)
-+		rs->rs_keyix = ATH9K_RXKEYIX_INVALID;
+@@ -713,6 +713,8 @@ int ath9k_hw_rxprocdesc(struct ath_hw *a
+ 			rs->rs_status |= ATH9K_RXERR_DECRYPT;
+ 		else if (ads.ds_rxstatus8 & AR_MichaelErr)
+ 			rs->rs_status |= ATH9K_RXERR_MIC;
++		else if (ads.ds_rxstatus8 & AR_KeyMiss)
++			rs->rs_status |= ATH9K_RXERR_DECRYPT;
+ 	}
  
- 	if ((ads.ds_rxstatus8 & AR_RxFrameOK) == 0) {
- 		if (ads.ds_rxstatus8 & AR_CRCErr)
+ 	return 0;
 --- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
 +++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
-@@ -578,6 +578,9 @@ int ath9k_hw_process_rxdesc_edma(struct 
- 	if (rxsp->status11 & AR_DecryptBusyErr)
- 		rxs->rs_flags |= ATH9K_RX_DECRYPT_BUSY;
+@@ -589,7 +589,8 @@ int ath9k_hw_process_rxdesc_edma(struct 
+ 			rxs->rs_status |= ATH9K_RXERR_DECRYPT;
+ 		} else if (rxsp->status11 & AR_MichaelErr) {
+ 			rxs->rs_status |= ATH9K_RXERR_MIC;
+-		}
++		} else if (rxsp->status11 & AR_KeyMiss)
++			rxs->rs_status |= ATH9K_RXERR_DECRYPT;
+ 	}
  
-+	if (rxsp->status11 & AR_KeyMiss)
-+		rxs->rs_keyix = ATH9K_RXKEYIX_INVALID;
-+
- 	if ((rxsp->status11 & AR_RxFrameOK) == 0) {
- 		if (rxsp->status11 & AR_CRCErr) {
- 			rxs->rs_status |= ATH9K_RXERR_CRC;
+ 	return 0;
diff --git a/package/mac80211/patches/540-ath9k_aggr_fix.patch b/package/mac80211/patches/540-ath9k_aggr_fix.patch
new file mode 100644
index 0000000000..0c9d887acf
--- /dev/null
+++ b/package/mac80211/patches/540-ath9k_aggr_fix.patch
@@ -0,0 +1,35 @@
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -329,7 +329,6 @@ static void ath_tx_complete_aggr(struct 
+ 	int isaggr, txfail, txpending, sendbar = 0, needreset = 0, nbad = 0;
+ 	bool rc_update = true;
+ 	struct ieee80211_tx_rate rates[4];
+-	unsigned long flags;
+ 
+ 	skb = bf->bf_mpdu;
+ 	hdr = (struct ieee80211_hdr *)skb->data;
+@@ -346,9 +345,21 @@ static void ath_tx_complete_aggr(struct 
+ 	if (!sta) {
+ 		rcu_read_unlock();
+ 
+-		spin_lock_irqsave(&sc->tx.txbuflock, flags);
+-		list_splice_tail_init(bf_q, &sc->tx.txbuf);
+-		spin_unlock_irqrestore(&sc->tx.txbuflock, flags);
++		INIT_LIST_HEAD(&bf_head);
++		while (bf) {
++			bf_next = bf->bf_next;
++
++			bf->bf_state.bf_type |= BUF_XRETRY;
++			if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) ||
++			    !bf->bf_stale || bf_next != NULL)
++				list_move_tail(&bf->list, &bf_head);
++
++			ath_tx_rc_status(bf, ts, 0, 0, false);
++			ath_tx_complete_buf(sc, bf, txq, &bf_head, ts,
++				0, 0);
++
++			bf = bf_next;
++		}
+ 		return;
+ 	}
+