else if (ni->ni_rssi > selbs->ni_rssi) { ieee80211_unref_node(&selbs);
else if (ni->ni_rssi > selbs->ni_rssi)
ieee80211_end_scan(struct ifnet *ifp){	struct ieee80211com *ic = (void *)ifp;	struct ieee80211_node *ni, *nextbs, *selbs;	int i, fail;	ic->ic_flags &= ~IEEE80211_F_ASCAN;	ni = TAILQ_FIRST(&ic->ic_node);	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {		/* XXX off stack? */		u_char occupied[roundup(IEEE80211_CHAN_MAX, NBBY)];		/*		 * The passive scan to look for existing AP's completed,		 * select a channel to camp on.  Identify the channels		 * that already have one or more AP's and try to locate		 * an unnoccupied one.  If that fails, pick a random		 * channel from the active set.		 */		for (; ni != NULL; ni = nextbs) {			ieee80211_ref_node(ni);			nextbs = TAILQ_NEXT(ni, ni_list);			setbit(occupied, ieee80211_chan2ieee(ic, ni->ni_chan));			ieee80211_free_node(ic, ni);		}		for (i = 0; i < IEEE80211_CHAN_MAX; i++)			if (isset(ic->ic_chan_active, i) && isclr(occupied, i))				break;		if (i == IEEE80211_CHAN_MAX) {			fail = arc4random() & 3;	/* random 0-3 */			for (i = 0; i < IEEE80211_CHAN_MAX; i++)				if (isset(ic->ic_chan_active, i) && fail-- == 0)					break;		}		ieee80211_create_ibss(ic, &ic->ic_channels[i]);		return;	}	if (ni == NULL) {		IEEE80211_DPRINTF(("%s: no scan candidate\n", __func__));  notfound:		if (ic->ic_opmode == IEEE80211_M_IBSS &&		    (ic->ic_flags & IEEE80211_F_IBSSON) &&		    ic->ic_des_esslen != 0) {			ieee80211_create_ibss(ic, ic->ic_ibss_chan);			return;		}		/*		 * Reset the list of channels to scan and start again.		 */		ieee80211_reset_scan(ifp);		ieee80211_next_scan(ifp);		return;	}	selbs = NULL;	if (ifp->if_flags & IFF_DEBUG)		if_printf(ifp, "\tmacaddr          bssid         chan  rssi rate flag  wep  essid\n");	for (; ni != NULL; ni = nextbs) {		ieee80211_ref_node(ni);		nextbs = TAILQ_NEXT(ni, ni_list);		if (ni->ni_fails) {			/*			 * The configuration of the access points may change			 * during my scan.  So delete the entry for the AP			 * and retry to associate if there is another beacon.			 */			if (ni->ni_fails++ > 2)				ieee80211_free_node(ic, ni);			continue;		}		if (ieee80211_match_bss(ic, ni) == 0) {			if (selbs == NULL)				selbs = ni;			else if (ni->ni_rssi > selbs->ni_rssi) {				ieee80211_unref_node(&selbs);				selbs = ni;			} else				ieee80211_unref_node(&ni);		} else {			ieee80211_unref_node(&ni);		}	}	if (selbs == NULL)		goto notfound;	(*ic->ic_node_copy)(ic, ic->ic_bss, selbs);	if (ic->ic_opmode == IEEE80211_M_IBSS) {		ieee80211_fix_rate(ic, ic->ic_bss, IEEE80211_F_DOFRATE |		    IEEE80211_F_DONEGO | IEEE80211_F_DODEL);		if (ic->ic_bss->ni_rates.rs_nrates == 0) {			selbs->ni_fails++;			ieee80211_unref_node(&selbs);			goto notfound;		}		ieee80211_unref_node(&selbs);		/*		 * Discard scan set; the nodes have a refcnt of zero		 * and have not asked the driver to setup private		 * node state.  Let them be repopulated on demand either		 * through transmission (ieee80211_find_txnode) or receipt		 * of a probe response (to be added).		 */		ieee80211_free_allnodes(ic);		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);	} else {		ieee80211_unref_node(&selbs);		ieee80211_new_state(ic, IEEE80211_S_AUTH, -1);	}}