Results collection model ?

I'm trying to implement an OpenCL bruteforcer for a 40bit keyspace.
My goal is to write some clean code that could be used to add support for WEP40 to oclHashcat, but as it is just a matter of bruteforcing 5 bytes + RC4 + CRC32, it may only require 10min to any oclHashcat developer to do this. Anyway, this isn't a request thread.

I've got a CPU OpenMP implementation working and I would like to port it on my GPUs.
I've got some questions about the models used by oclHashcat to manage the communication between the OpenCL host (CPU) and the OpenCL device (GPU).

Am I right when I think that oclHashcat uploads a set of N words from a dictionary to an input buffer on the OpenCL device memory ?

Am I right when I think that oclHashcat writes a set of N keys directly on the OpenCL device memory when possible (e.g. with a pattern or a mask) ?

How are the results collected ?

Thank you Smile
There's no point in adding WEP to oclHashcat when it can be cracked in under 2 minutes on a mobile phone.
Sorry, I shouldn't have talked about WEP.
My question about the result collection model is still open.
I'm a little bit lost in the oclHashcat source code, and would appreciate any hint.
without having dug too deep it looks like result collection happens in and