Ipw2200 can inject, but only in certain conditions:

• Card has to be in managed mode and associated to an ap.
• It can only inject data packets.

Known this, it is possible (has been successfully tested) attack 2 and 4, and probably also 3.

See the ipw2200-inject patches, and read this thread in forum.