The author's PhD thesis on the framework he built to modify the Broadcom WiFi firmware looks really interesting, and presents several other ways to take advantage of the low-level control of the hardware.
http://tuprints.ulb.tu-darmstadt.de/7243/7/dissertation_2018...