< Rogue Access Points, a how-to | A quick view on IBM's approach to mainframe security disclosures >
DigiNinja wrote a set of patches for hostapd that allow it to operate in KARMA mode (i.e. respond to any probe in an attempt to fool wifi devices into joining it). His last set of patches were for v1.0. I spent some time porting them to v2.0 of hostapd.
The functionality is exactly the same (although the probe response is a little more aggressive), and you can grab either the patch or the full tarball here: