Odd WLAN Device Problem

I'm trying to help convert my boss over to Linux. He has an HP/Compaq PC on which he installed Fedora Core 4 on. It's got a Linksys wireless card in it and we're using the NDIS wrapper to load the Windows driver for the chipset on that card. 'iwconfig' sees the card. We can configure the card. And when he has his wired NIC plugged in, I can actually ping both his wired AND his WIRELESS IP addresses. But as soon as he disconnects the cable, I lose contact with his wireless NIC.

Even stranger, I was actually able to ssh into his box via the wireless IP address, and do an ifdown eth0 and remain connected (as long as his wired NIC was plugged in). If I do an 'ifconfig' when his eth0 is down all I see is 'wlan0' and 'lo'. So it would SEEM that the WLAN card is working but is somehow realy being routed through his wired NIC. It doesn't make sense. I've tried configuring his system so that the wired NIC doesn't come up at boot, but then he gets no access (even though 'iwconfig' says it sees the access point). I've tried manually forcing the system to use wlan0 to get to it's default route but it can't. Oddly, if I change the encryption key for the wlan0 card, it losses contact with the access point and displays all zeros for the AP Mac address, but as soon as I put the right key back in... it gets the AP MAC address back!

This is one of the strangest issues I've ever run into and I can't seem to figure out what's causing it. Any ideas? (NOTE: The AP is a Cisco AP, not Linksys) The NIC itself appears to be using a Broadcom chip:

05:04.0 Network controller: Broadcom Corporation BCM4306 802.11b/g Wireless LAN Controller (rev 03)

Here is the output of 'ifconfig':

eth0      Link encap:Ethernet  HWaddr 00:11:0A:99:62:19
         inet addr:10.128.23.26  Bcast:10.128.23.255  Mask:255.255.255.0
         inet6 addr: fe80::211:aff:fe99:6219/64 Scope:Link
         UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
         RX packets:270848 errors:0 dropped:0 overruns:0 frame:0
         TX packets:265538 errors:0 dropped:0 overruns:0 carrier:0
         collisions:0 txqueuelen:1000
         RX bytes:156823981 (149.5 MiB)  TX bytes:40767908 (38.8 MiB)
         Interrupt:177

lo        Link encap:Local Loopback
         inet addr:127.0.0.1  Mask:255.0.0.0
         inet6 addr: ::1/128 Scope:Host
         UP LOOPBACK RUNNING  MTU:16436  Metric:1
         RX packets:3158 errors:0 dropped:0 overruns:0 frame:0
         TX packets:3158 errors:0 dropped:0 overruns:0 carrier:0
         collisions:0 txqueuelen:0
         RX bytes:1383009 (1.3 MiB)  TX bytes:1383009 (1.3 MiB)

wlan0     Link encap:Ethernet  HWaddr 00:12:17:7E:B1:C9
         inet addr:10.128.23.4  Bcast:10.128.23.255  Mask:255.255.255.0
         inet6 addr: fe80::212:17ff:fe7e:b1c9/64 Scope:Link
         UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
         RX packets:22656 errors:0 dropped:0 overruns:0 frame:0
         TX packets:2 errors:0 dropped:0 overruns:0 carrier:0
         collisions:0 txqueuelen:1000
         RX bytes:2011519 (1.9 MiB)  TX bytes:132 (132.0 b)
         Interrupt:185 Memory:fc510000-fc512000 

Here is the output of 'iwconfig':

wlan0     IEEE 802.11g  ESSID:"MYESSID"  Nickname:"linuxhome.boss.prv"
          Mode:Managed  Frequency:2.412 GHz  Access Point: 00:11:20:8D:6C:80
          Bit Rate=48 Mb/s   Tx-Power:25 dBm
          RTS thr=2347 B   Fragment thr=2346 B
          Encryption key:XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XX   Security mode:open
          Power Management:off
          Link Quality:100/100  Signal level:-64 dBm  Noise level:-256 dBm
          Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:0  Invalid misc:0   Missed beacon:0

Here is the output of 'route':

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.128.23.0     *               255.255.255.0   U     0      0        0 eth0
10.128.23.0     *               255.255.255.0   U     0      0        0 wlan0
169.254.0.0     *               255.255.0.0     U     0      0        0 wlan0
default         10.128.23.1     0.0.0.0         UG    0      0        0 eth0

Here is the output of 'ping' through wlan0:

[root@linuxhome ~]# ping -I wlan0 10.0.1.1
PING 10.0.1.1 (10.0.1.1) from 10.128.23.4 wlan0: 56(84) bytes of data.
From 10.128.23.4 icmp_seq=0 Destination Host Unreachable
From 10.128.23.4 icmp_seq=1 Destination Host Unreachable
From 10.128.23.4 icmp_seq=2 Destination Host Unreachable
From 10.128.23.4 icmp_seq=4 Destination Host Unreachable
From 10.128.23.4 icmp_seq=5 Destination Host Unreachable
From 10.128.23.4 icmp_seq=6 Destination Host Unreachable
From 10.128.23.4 icmp_seq=8 Destination Host Unreachable
From 10.128.23.4 icmp_seq=9 Destination Host Unreachable
From 10.128.23.4 icmp_seq=10 Destination Host Unreachable

Here is the output of 'ping' through eth0:

[root@linuxhome ~]# ping -I eth0 10.0.1.1
PING 10.0.1.1 (10.0.1.1) from 10.128.23.26 eth0: 56(84) bytes of data.
64 bytes from 10.0.1.1: icmp_seq=0 ttl=253 time=62.4 ms
64 bytes from 10.0.1.1: icmp_seq=1 ttl=253 time=59.1 ms
64 bytes from 10.0.1.1: icmp_seq=2 ttl=253 time=60.6 ms
64 bytes from 10.0.1.1: icmp_seq=3 ttl=253 time=60.6 ms