diff --git a/core/rtw_xmit.c b/core/rtw_xmit.c
index fa6bef3..95d08e5 100644
--- a/core/rtw_xmit.c
+++ b/core/rtw_xmit.c
@@ -3777,6 +3777,21 @@ int rtw_ieee80211_radiotap_iterator_init(
 	struct ieee80211_radiotap_header *radiotap_header,
 	int max_length, const struct ieee80211_radiotap_vendor_namespaces *vns);
 
+static struct xmit_frame* monitor_alloc_mgtxmitframe(struct xmit_priv *pxmitpriv) {
+	int tries;
+	int delay = 300;
+	struct xmit_frame *pmgntframe = NULL;
+
+	for(tries = 3; tries >= 0; tries--) {
+		pmgntframe = alloc_mgtxmitframe(pxmitpriv);
+		if(pmgntframe != NULL)
+			return pmgntframe;
+		rtw_udelay_os(delay);
+		delay += delay/2;
+	}
+	return NULL;
+}
+
 s32 rtw_monitor_xmit_entry(struct sk_buff *skb, struct net_device *ndev)
 {
 	int ret = 0;
@@ -3822,6 +3837,11 @@ s32 rtw_monitor_xmit_entry(struct sk_buff *skb, struct net_device *ndev)
 	if (unlikely(skb->len < rtap_len))
 		goto fail;
 
+	if ((pmgntframe = monitor_alloc_mgtxmitframe(pxmitpriv)) == NULL) {
+		DBG_COUNTER(padapter->tx_logs.core_tx_err_pxmitframe);
+		return NETDEV_TX_BUSY;
+	}
+
 	ret = rtw_ieee80211_radiotap_iterator_init(&iterator, rtap_hdr, skb->len, NULL);
 	while (!ret) {
 		ret = rtw_ieee80211_radiotap_iterator_next(&iterator);
@@ -3902,11 +3922,7 @@ s32 rtw_monitor_xmit_entry(struct sk_buff *skb, struct net_device *ndev)
 //	dot11_hdr = (struct ieee80211_hdr *)skb->data;
 //	frame_ctl = le16_to_cpu(dot11_hdr->frame_control);
 	/* Check if the QoS bit is set */
-	
-	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL) {
-		rtw_udelay_os(500);
-		goto fail;
-	}
+
 	pattrib = &pmgntframe->attrib;
 	update_monitor_frame_attrib(padapter, pattrib);
 
@@ -3935,10 +3951,11 @@ s32 rtw_monitor_xmit_entry(struct sk_buff *skb, struct net_device *ndev)
 
 	pattrib->last_txcmdsz = pattrib->pktlen;
 	dump_mgntframe(padapter, pmgntframe);
+	DBG_COUNTER(padapter->tx_logs.core_tx);
 		
 fail:
 	rtw_skb_free(skb);
-	return 0;
+	return NETDEV_TX_OK;
 }
 
 /*
diff --git a/include/rtw_xmit.h b/include/rtw_xmit.h
index 53d324b..64f1f5c 100644
--- a/include/rtw_xmit.h
+++ b/include/rtw_xmit.h
@@ -81,7 +81,7 @@
 #ifdef CONFIG_SINGLE_XMIT_BUF
 #define NR_XMIT_EXTBUFF	(1)
 #else
-#define NR_XMIT_EXTBUFF	(32)
+#define NR_XMIT_EXTBUFF	(64)
 #endif
 
 #ifdef CONFIG_RTL8812A
diff --git a/os_dep/linux/xmit_linux.c b/os_dep/linux/xmit_linux.c
index 2312b58..3d35858 100644
--- a/os_dep/linux/xmit_linux.c
+++ b/os_dep/linux/xmit_linux.c
@@ -533,7 +533,7 @@ int rtw_xmit_entry(_pkt *pkt, _nic_hdl pnetdev)
 
 	if (pkt) {
 		if (check_fwstate(pmlmepriv, WIFI_MONITOR_STATE) == _TRUE) {
-			rtw_monitor_xmit_entry((struct sk_buff*)pkt, pnetdev);
+			ret = rtw_monitor_xmit_entry((struct sk_buff*)pkt, pnetdev);
 		} else {
 			rtw_mstat_update(MSTAT_TYPE_SKB, MSTAT_ALLOC_SUCCESS, pkt->truesize);
 			ret = _rtw_xmit_entry(pkt, pnetdev);