--- /dev/null
+Index: wpa_supplicant-0.6.3/wpa_supplicant/wpa_supplicant.c
+===================================================================
+--- wpa_supplicant-0.6.3.orig/wpa_supplicant/wpa_supplicant.c 2008-07-24 16:28:58.000000000 +0200
++++ wpa_supplicant-0.6.3/wpa_supplicant/wpa_supplicant.c 2008-07-24 16:47:40.000000000 +0200
+@@ -1182,7 +1182,7 @@
+ {
+ #define SCAN_AP_LIMIT 128
+ struct wpa_scan_result *results;
+- int num, i;
++ int num, i, j;
+ struct wpa_scan_results *res;
+
+ results = os_malloc(SCAN_AP_LIMIT * sizeof(struct wpa_scan_result));
+@@ -1279,6 +1279,21 @@
+ res->res[res->num++] = r;
+ }
+
++ /* sort scan results by quality */
++ for(i = 0; i < num - 1; i++) {
++ for(j = i + 1; j < num; j++) {
++ struct wpa_scan_result tmp;
++
++ if (results[i].qual > results[j].qual)
++ continue;
++
++ os_memcpy(&tmp, &results[i], sizeof(tmp));
++ os_memcpy(&results[i], &results[j], sizeof(tmp));
++ os_memcpy(&results[j], &tmp, sizeof(tmp));
++ }
++ }
++
++
+ os_free(results);
+ wpa_s->scan_res = res;
+