Thanks to Jouni Malinen on the HOSTAP list, he told me that:
1) ap_scan is a global variable - it should be up with the ctrl_interface lines at the beginning of the file - it can't be in any network block
2) I needed to add to my .config file CONFIG_CTRL_IFACE=y to use the ctrl_interface lines in .config. running make again and copying the files over to /usr/local/bin did the trick.
Now I discovered that my DI-614+ requires ap_scan to equal 1 (0 or 2 won't work) AND I have to enable broadcast ssid
Anybody got any ideas on how to configure wpa_supplicant to NOT require that? Or is this a NDISWrapper issue?