It looks like madwifi driver is still reporting only one WPA/RSN IE even when the AP is advertising both WPA (WPA IE) and WPA2 (RSN IE). Both IEs need to be included in scan results so that user space supplicant is able to do proper downgrade attack protection and allow user to configure WPA in this kind of case. Based on svn commit messages, it looks like WPA2 is now preferred, i.e., RSN IE overwrites WPA IE if both are present in Beacon/ProbeRsp. However, the correct behavior would to report both IEs and allow supplicant to take care of deciding what to do with them.
This has been reported as wpa_supplicant issue number of times (see, e.g., http://hostap.epitest.fi/bugz/show_bug.cgi?id=75), but the real problem is in the driver not providing the needed information.
