Confirm the subnet masks of the AP's that only respond when pung on the broadcast.
For giggles, since your network doesn't seem so large that it would need THAT much address space anyways (a class B's worth), cut your subnet mask down to 255.255.255.0 on your whole network... anything change?
__________________
Network Firefighter
|