These guys have reverse-engineered the Broadcom 43xx wireless chipset and are writing a GPL'd replacement driver. Broadcom are the kind folks who won't release binary-only drivers, let alone datasheets, for their stuff, which means the only thing you can do is run NDISWrapper (Linux) or Project Evil (FreeBSD).
My wife and I share an Apple iBook with an Airport Extreme card that, natch, won't do passive mode. However, the reverse-engineered specs are available, which should help this guy in his efforts to write a new driver. I think I'll drop him (and the Kismac folks) a line and point it out.