diff --git a/sys/dev/ath/if_ath_rx.c b/sys/dev/ath/if_ath_rx.c
index 53d6c8b27c9..3c40f17bc39 100644
--- a/sys/dev/ath/if_ath_rx.c
+++ b/sys/dev/ath/if_ath_rx.c
@@ -403,11 +403,27 @@ ath_rx_tap_vendor(struct ifnet *ifp, struct mbuf *m,
 	sc->sc_rx_th.wr_v.evm[3] = rs->rs_evm3;
 	sc->sc_rx_th.wr_v.evm[4] = rs->rs_evm4;
 
+	/* direction */
+	sc->sc_rx_th.wr_v.vh_flags = ATH_VENDOR_PKT_RX;
+
+	/* RX rate */
+	sc->sc_rx_th.wr_v.vh_rx_hwrate = rs->rs_rate;
+
+	/* RX flags */
+	sc->sc_rx_th.wr_v.vh_rs_flags = rs->rs_flags;
+
+	if (rs->rs_isaggr)
+		sc->sc_rx_th.wr_v.vh_flags |= ATH_VENDOR_PKT_ISAGGR;
+	if (rs->rs_moreaggr)
+		sc->sc_rx_th.wr_v.vh_flags |= ATH_VENDOR_PKT_MOREAGGR;
+
 	/* phyerr info */
-	if (rs->rs_status & HAL_RXERR_PHY)
+	if (rs->rs_status & HAL_RXERR_PHY) {
 		sc->sc_rx_th.wr_v.vh_phyerr_code = rs->rs_phyerr;
-	else
+		sc->sc_rx_th.wr_v.vh_flags |= ATH_VENDOR_PKT_RXPHYERR;
+	} else {
 		sc->sc_rx_th.wr_v.vh_phyerr_code = 0xff;
+	}
 	sc->sc_rx_th.wr_v.vh_rs_status = rs->rs_status;
 	sc->sc_rx_th.wr_v.vh_rssi = rs->rs_rssi;
 }
diff --git a/sys/dev/ath/if_athioctl.h b/sys/dev/ath/if_athioctl.h
index 05562ace7c4..577b7597bcd 100644
--- a/sys/dev/ath/if_athioctl.h
+++ b/sys/dev/ath/if_athioctl.h
@@ -305,7 +305,16 @@ struct ath_radiotap_vendor_hdr {		/* 30 bytes */
 	uint8_t		vh_phyerr_code;	/* Phy error code, or 0xff */
 	uint8_t		vh_rs_status;	/* RX status */
 	uint8_t		vh_rssi;	/* Raw RSSI */
-	uint8_t		vh_pad1[1];	/* Pad to 4 byte boundary */
+	uint8_t		vh_flags;	/* General flags */
+#define	ATH_VENDOR_PKT_RX	0x01
+#define	ATH_VENDOR_PKT_TX	0x02
+#define	ATH_VENDOR_PKT_RXPHYERR	0x04
+#define	ATH_VENDOR_PKT_ISAGGR	0x08
+#define	ATH_VENDOR_PKT_MOREAGGR	0x10
+
+	uint8_t		vh_rx_hwrate;	/* hardware RX ratecode */
+	uint8_t		vh_rs_flags;	/* RX HAL flags */
+	uint8_t		vh_pad[2];	/* pad to DWORD boundary */
 } __packed;
 #endif	/* ATH_ENABLE_RADIOTAP_VENDOR_EXT */