diff --git a/src/ARM.h b/src/ARM.h
index b652e74d..1403d91a 100644
--- a/src/ARM.h
+++ b/src/ARM.h
@@ -323,6 +323,7 @@ public:
     u32 CP15Control;
 
     u32 RNGSeed;
+    u32 TraceProcessID;
 
     u32 DTCMSetting, ITCMSetting;
 
diff --git a/src/CP15.cpp b/src/CP15.cpp
index c271e180..e924bff3 100644
--- a/src/CP15.cpp
+++ b/src/CP15.cpp
@@ -44,6 +44,7 @@ void ARMv5::CP15Reset()
     CP15Control = 0x2078; // dunno
 
     RNGSeed = 44203;
+    TraceProcessID = 0;
 
     DTCMSetting = 0;
     ITCMSetting = 0;
@@ -643,6 +644,10 @@ void ARMv5::CP15Write(u32 id, u32 val)
         UpdateITCMSetting();
         return;
 
+    case 0xD01:
+        TraceProcessID = val;
+        return;
+
     case 0xF00:
         //printf("cache debug index register %08X\n", val);
         return;
@@ -760,6 +765,9 @@ u32 ARMv5::CP15Read(u32 id) const
         return DTCMSetting;
     case 0x911:
         return ITCMSetting;
+
+    case 0xD01:
+        return TraceProcessID;
     }
 
     if ((id & 0xF00) == 0xF00) // test/debug shit?
diff --git a/src/DSi_NAND.cpp b/src/DSi_NAND.cpp
index a6b6c566..13eadd6e 100644
--- a/src/DSi_NAND.cpp
+++ b/src/DSi_NAND.cpp
@@ -189,20 +189,18 @@ void NANDImage::SetupFATCrypto(AES_ctx* ctx, u32 ctr)
     u8 iv[16];
     memcpy(iv, FATIV.data(), sizeof(iv));
 
-    u32 res;
-    res = iv[15] + (ctr & 0xFF);
-    iv[15] = (res & 0xFF);
-    res = iv[14] + ((ctr >> 8) & 0xFF) + (res >> 8);
-    iv[14] = (res & 0xFF);
-    res = iv[13] + ((ctr >> 16) & 0xFF) + (res >> 8);
-    iv[13] = (res & 0xFF);
-    res = iv[12] + (ctr >> 24) + (res >> 8);
-    iv[12] = (res & 0xFF);
-    iv[11] += (res >> 8);
-    for (int i = 10; i >= 0; i--)
-    {
-        if (iv[i+1] == 0) iv[i]++;
-        else break;
+    u8 ctr_value[16] = {0};
+    ctr_value[15] = ctr & 0xFF;
+    ctr_value[14] = (ctr >> 8) & 0xFF;
+    ctr_value[13] = (ctr >> 16) & 0xFF;
+    ctr_value[12] = (ctr >> 24) & 0xFF;
+
+    unsigned carry = 0;
+    for (unsigned i = 0; i < 16; i ++) {
+        unsigned j = 15-i;
+        unsigned x = iv[j] + ctr_value[j] + carry;
+        carry = x >= 0x100;
+        iv[j] = x;
     }
 
     AES_init_ctx_iv(ctx, FATKey.data(), iv);
diff --git a/src/DSi_NWifi.cpp b/src/DSi_NWifi.cpp
index 9827bdbe..9cfb0203 100644
--- a/src/DSi_NWifi.cpp
+++ b/src/DSi_NWifi.cpp
@@ -31,7 +31,7 @@ using Platform::Log;
 using Platform::LogLevel;
 
 
-const u8 CIS0[256] =
+u8 CIS0[256] =
 {
     0x01, 0x03, 0xD9, 0x01, 0xFF,
     0x20, 0x04, 0x71, 0x02, 0x00, 0x02,
@@ -70,7 +70,7 @@ const u8 CIS0[256] =
     0x00, 0x00, 0x00
 };
 
-const u8 CIS1[256] =
+u8 CIS1[256] =
 {
     0x20, 0x04, 0x71, 0x02, 0x00, 0x02,
     0x21, 0x02, 0x0C, 0x00,
@@ -201,6 +201,9 @@ void DSi_NWifi::Reset()
         break;
     }
 
+    CIS0[9] = ChipID >= 0x0D000000;
+    CIS1[4] = CIS0[9];
+
     memset(EEPROM, 0, 0x400);
 
     *(u32*)&EEPROM[0x000] = 0x300;
@@ -227,6 +230,8 @@ void DSi_NWifi::Reset()
     BeaconTimer = 0x10A2220ULL;
     ConnectionStatus = 0;
 
+    SendBSSInfo = true;
+
     DSi.CancelEvent(Event_DSi_NWifi);
 }
 
@@ -1001,7 +1006,7 @@ void DSi_NWifi::WMI_Command()
                 }
 
                 // checkme
-                ScanTimer = scantime*5;
+                ScanTimer = scantime*8;
             }
             break;
 
@@ -1036,6 +1041,7 @@ void DSi_NWifi::WMI_Command()
 
                 // TODO: store it somewhere
                 Log(LogLevel::Debug, "WMI: set probed SSID: id=%d, flags=%02X, len=%d, SSID=%s\n", id, flags, len, ssid);
+                SendBSSInfo = flags == 0 || strcmp(ssid, WifiAP::APName) == 0;
             }
             break;
 
@@ -1405,6 +1411,11 @@ void DSi_NWifi::SendWMIAck(u8 ep)
 
 void DSi_NWifi::SendWMIBSSInfo(u8 type, u8* data, u32 len)
 {
+    if (!SendBSSInfo) {
+        Log(LogLevel::Info, "NWifi: melonAP filtered, not sending WMI BSSINFO event\n");
+        return;
+    }
+
     if (!Mailbox[8].CanFit(6+len+2+16))
     {
         Log(LogLevel::Error, "NWifi: !! not enough space in RX buffer for WMI BSSINFO event\n");
diff --git a/src/DSi_NWifi.h b/src/DSi_NWifi.h
index 84ac8a49..4140820b 100644
--- a/src/DSi_NWifi.h
+++ b/src/DSi_NWifi.h
@@ -147,6 +147,8 @@ private:
     u32 ConnectionStatus;
 
     u8 LANBuffer[2048];
+
+    bool SendBSSInfo;
 };
 
 }
diff --git a/src/NDS.cpp b/src/NDS.cpp
index bf2e4283..d82da97b 100644
--- a/src/NDS.cpp
+++ b/src/NDS.cpp
@@ -2729,6 +2729,9 @@ u8 NDS::ARM9IORead8(u32 addr)
     case 0x04000132: return KeyCnt[0] & 0xFF;
     case 0x04000133: return KeyCnt[0] >> 8;
 
+    case 0x04000180: return IPCSync9 & 0xFF;
+    case 0x04000181: return IPCSync9 >> 8;
+
     case 0x040001A0:
         if (!(ExMemCnt[0] & (1<<11)))
             return NDSCartSlot.GetSPICnt() & 0xFF;
@@ -3168,6 +3171,17 @@ void NDS::ARM9IOWrite8(u32 addr, u8 val)
         KeyCnt[0] = (KeyCnt[0] & 0x00FF) | (val << 8);
         return;
 
+    case 0x04000181:
+        IPCSync7 &= 0xFFF0;
+        IPCSync7 |= (val & 0x0F);
+        IPCSync9 &= 0xB0FF;
+        IPCSync9 |= ((val & 0x4F) << 8);
+        if ((val & 0x20) && (IPCSync7 & 0x4000))
+        {
+            SetIRQ(1, IRQ_IPCSync);
+        }
+        return;
+
     case 0x04000188:
         NDS::ARM9IOWrite32(addr, val | (val << 8) | (val << 16) | (val << 24));
         return;
@@ -3659,6 +3673,9 @@ u8 NDS::ARM7IORead8(u32 addr)
 
     case 0x04000138: return RTC.Read() & 0xFF;
 
+    case 0x04000180: return IPCSync7 & 0xFF;
+    case 0x04000181: return IPCSync7 >> 8;
+
     case 0x040001A0:
         if (ExMemCnt[0] & (1<<11))
             return NDSCartSlot.GetSPICnt() & 0xFF;
@@ -3967,6 +3984,17 @@ void NDS::ARM7IOWrite8(u32 addr, u8 val)
 
     case 0x04000138: RTC.Write(val, true); return;
 
+    case 0x04000181:
+        IPCSync9 &= 0xFFF0;
+        IPCSync9 |= (val & 0x0F);
+        IPCSync7 &= 0xB0FF;
+        IPCSync7 |= ((val & 0x4F) << 8);
+        if ((val & 0x20) && (IPCSync9 & 0x4000))
+        {
+            SetIRQ(0, IRQ_IPCSync);
+        }
+        return;
+
     case 0x04000188:
         NDS::ARM7IOWrite32(addr, val | (val << 8) | (val << 16) | (val << 24));
         return;