I'm surprised to hear that bcm4318 is not working on bt3 and partially working on bt4 (beta or pre-final?).
BT3 would be using the non-mac80211 equivalent driver known as bcm43xx which is fairly limited support and is deprecated in favour of a common mac80211 stack which unifies many chipsets/drivers into one base, etc. A tell tale sign would be ethX entry for bcm43xx
BT4 and the driver used is b43 which is the latter and much favoured as it uses mac80211 stack. Injection should work with literally most if not all parts when used with bt4pf (the latter the kernel version, the better generally). The interface for the device will appear as wlan0.
It should not fail at packet injection if you are using backtrack as those drivers came pre-patched and ready for injection. Injection tests are just random mac assignments probing on a randomly found AP. If your injection fails, you are probably running things like networkmanager, wpa_supplicant, dhclient, airodump-ng, kismet which you shouldn't be as it will mess around with the modes on the interface as listed. Try killing such processes and any other ones that are tampering with the device (iwevent can sometimes be helpful here) and try again.
10,000 packets is more like 10,000 IVs but it depends on your network and how long is the key length, the longer it is, the more IVs it will require. Furthermore if injection does fail, you can always do passively rfmon on the same channel and on single AP. Have another client using wireless to send packets back and forth and your IVs will eventually increase. Remember, injection is optional and is not mandatory if you are breaking your own network :P
I have bcm4318 (linksys wpc54gv3) it works but because its pcmcia card with no external antenna connector, the range is a little poor and at times I have to re-orientate my laptop to pick up an AP at times.
Yes only USB is supported, nothing else.


Hope that helps.
