I was able to get Passive mode scanning working on my AirPort Extreme
with KisMac R83 on my iBook G4/14"/1.42Ghz. It's been repeatable
across reboots, and the Airport driver now reloads properly when I
quit KisMac too. Huzzah!
I tried shutting down anything that might have a hold on the Airport driver -- Appletalk, Remote Login, Remote Desktop, etc. That still didn't help. I did a 'sudo kextunload AppleAirport2.kext' and got the usual failure message -- can't unload due to X instances. But then I had the bright idea to run kextunload AGAIN, and this time the unload succeeded. I then ran KisMac and passive mode scanning worked. I rebooted, re-enabled Remote Login and Remote Desktop, and KisMac still worked properly.
I haven't had a chance to try re-enabling AppleTalk to see if things fail again, but I'm happy to say passive is doable without a safeboot!