diff --git a/package/kernel/broadcom-wl/files/lib/wifi/broadcom.sh b/package/kernel/broadcom-wl/files/lib/wifi/broadcom.sh
index 9416f77b23..614db0cf0b 100644
--- a/package/kernel/broadcom-wl/files/lib/wifi/broadcom.sh
+++ b/package/kernel/broadcom-wl/files/lib/wifi/broadcom.sh
@@ -108,12 +108,14 @@ disable_broadcom() {
 
 		# make sure all of the devices are disabled in the driver
 		local ifdown=
-		local vif
+		local bssmax=$(wlc ifname "$device" bssmax)
+		local vif=$((${bssmax:-4} - 1))
 		append ifdown "down" "$N"
 		append ifdown "wds none" "$N"
-		for vif in 3 2 1 0; do
+		while [ $vif -ge 0 ]; do
 			append ifdown "vif $vif" "$N"
 			append ifdown "enabled 0" "$N"
+			vif=$(($vif - 1))
 		done
 
 		wlc ifname "$device" stdin <<EOF
@@ -209,8 +211,12 @@ enable_broadcom() {
 	local nas="$(which nas)"
 	local if_pre_up if_up nas_cmd
 	local vif vif_pre_up vif_post_up vif_do_up vif_txpower
+	local bssmax=$(wlc ifname "$device" bssmax)
+	bssmax=${bssmax:-4}
 
 	for vif in $vifs; do
+		[ $_c -ge $bssmax ] && break
+
 		config_get vif_txpower "$vif" txpower
 
 		local mode
diff --git a/package/kernel/broadcom-wl/src/wlc.c b/package/kernel/broadcom-wl/src/wlc.c
index 21754a798c..50c40e802f 100644
--- a/package/kernel/broadcom-wl/src/wlc.c
+++ b/package/kernel/broadcom-wl/src/wlc.c
@@ -391,6 +391,37 @@ static int wlc_wsec_key(wlc_param param, void *null, void *value)
 	return wl_bssiovar_set(interface, "wsec_key", vif, &wsec_key, sizeof(wsec_key));
 }
 
+static int wlc_cap(wlc_param param, void *data, void *value)
+{
+	char *iov = *((char **) data);
+
+	if (param & GET)
+		return wl_iovar_get(interface, iov, value, BUFSIZE);
+
+	return -1;
+}
+
+static int wlc_bssmax(wlc_param param, void *data, void *value)
+{
+	int *val = (int *) value;
+	char *iov = *((char **) data);
+	int ret = -1;
+
+	if (param & GET) {
+		ret = wl_iovar_get(interface, iov, wlbuf, BUFSIZE);
+		if (!ret) {
+			if (strstr(wlbuf, "mbss4"))
+				*val = 4;
+			else if (strstr(wlbuf, "mbss16"))
+				*val = 16;
+			else
+				*val = 1;
+		}
+	}
+
+	return ret;
+}
+
 static inline int cw2ecw(int cw)
 {
 	int i;	
@@ -954,6 +985,20 @@ static const struct wlc_call wlc_calls[] = {
 		.handler = wlc_ioctl,
 		.desc = "Band (0=auto, 1=5Ghz, 2=2.4GHz)"
 	},
+	{
+		.name = "cap",
+		.param = STRING|NOARG,
+		.handler = wlc_cap,
+		.data.str = "cap",
+		.desc = "Capabilities"
+	},
+	{
+		.name = "bssmax",
+		.param = INT|NOARG,
+		.handler = wlc_bssmax,
+		.data.str = "cap",
+		.desc = "Number of VIF's supported"
+	},
 };
 #define wlc_calls_size (sizeof(wlc_calls) / sizeof(struct wlc_call))