Packets in packets: in-band signaling attack for modern radios (2011) [pdf]

Discussed at the time:

Packets in Packets: Orson Welles’ In-Band Signaling Attacks for Modern Radios - https://news.ycombinator.com/item?id=2966910 - Sept 2011 (2 comments)

(I de-Orsoned this title because someone is bound to kick up a fuss about it being misleading.)

I doubt this is limited to wireless networks. For example I'd bet this could maybe be used to as a "fun" way to escape 802.1q as long as the parent network doesn't make use of 802.1x encryption.