We're using madwifi-ng 0.9.4 on MIPS and experience occasional kernel panics resulting in a reboot.
In dump1: ath_tx_processq+0x2f4 objdump is at address 83f4:
/var/tmp/portage/madwifi-ng-0.9.4/work/madwifi-0.9.4/ath/if_ath.c:7344
83f0: 8e030004 lw v1,4(s0)
83f4: 8c620abc lw v0,2748(v1)
83f8: 24420001 addiu v0,v0,1
83fc: ac620abc sw v0,2748(v1)
if_ath.c:7334 looks like:
ni->ni_ic->ic_wme.wme_hipri_traffic++;
In dump2 it crashes in ieee80211_node.c, which is called from
ath.c:7385 ieee80211_free_node(ni);
Both cases suggest that 'ni' is somehow corrupt.
Attached dump1 and dump2
