diff --git a/sys/dev/wtap/if_wtap.c b/sys/dev/wtap/if_wtap.c
--- a/sys/dev/wtap/if_wtap.c
+++ b/sys/dev/wtap/if_wtap.c
@@ -297,6 +297,7 @@
 		switch (vap->iv_opmode) {
 		case IEEE80211_M_IBSS:
 		case IEEE80211_M_MBSS:
+		case IEEE80211_M_HOSTAP:
 			/*
 			 * Stop any previous beacon callout. This may be
 			 * necessary, for example, when an ibss merge
@@ -590,6 +591,16 @@
 	    (struct ieee80211_node *) m->m_pkthdr.rcvif;
 	struct ieee80211vap *vap = ni->ni_vap;
 	struct wtap_vap *avp = WTAP_VAP(vap);
+	struct ieee80211_key *k;
+	struct ieee80211_frame *wh;
+
+	wh = mtod(m, struct ieee80211_frame *);
+
+	if (IEEE80211_IS_PROTECTED(wh)) {
+		k = ieee80211_crypto_encap(ni, m);
+		if (k == NULL)
+			return (ENOBUFS);
+	}
 
 	if (ieee80211_radiotap_active_vap(vap))
 		ieee80211_radiotap_tx(vap, m);
@@ -642,7 +653,18 @@
 	ic->ic_name = sc->name;
 	ic->ic_phytype = IEEE80211_T_DS;
 	ic->ic_opmode = IEEE80211_M_MBSS;
-	ic->ic_caps = IEEE80211_C_MBSS | IEEE80211_C_IBSS;
+	ic->ic_caps =
+		  IEEE80211_C_MBSS		/* mesh point link mode */
+		| IEEE80211_C_IBSS		/* ibss, nee adhoc, mode */
+		| IEEE80211_C_STA		/* station mode */
+		| IEEE80211_C_HOSTAP		/* hostap mode */
+		| IEEE80211_C_WPA;		/* capable of WPA1+WPA2 */
+
+	ic->ic_cryptocaps =
+		  IEEE80211_CRYPTO_WEP
+		| IEEE80211_CRYPTO_AES_CCM
+		| IEEE80211_CRYPTO_TKIP
+		| IEEE80211_CRYPTO_TKIPMIC;
 
 	ic->ic_max_keyix = 128; /* A value read from Atheros ATH_KEYMAX */