urtwn and hostap

[Andriy Voskoboinyk]

> ieee80211_free_node() at ieee80211_free_node()_0x38/frame  
> 0xfffffe0092fe8780
> ieee80211_node_vdetach() at ieee80211_node_vdetach()+0x2d/frame  
> 0xfffffe0092fe87a0
> ieee80211_vap_detach() at ieee80211_vap_detach()+0x35e/frame  
> 0xfffffe0092fe87d0
> urtwn_vap_delete() at urtwn_vap_delete()+0xe/frame 0xfffffe0092fe87f0
> if_clone_destroyif() at if_clone_destroyif()+0x1aa/frame  
> 0xfffffe0092fe8840
> if_clone_destroy() at if_clone_destroy()0x8e/frame 0xfffffe0092fe8860
> kern_ioctl() at kern_ioctl()+0x230/frame 0xfffffe0092fe88c0
> sys_ioctl() at sys_ioctl()+0x153/frame 0xfffffe0092fe89a0
> amd64_syscall() at amd64_syscall()+0x282/frame 0xfffffe0092fe8ab0
> Xfast_syscall() at Xfast_syscall()+0xfb/frame 0xfffffe0092fe8ab0
> -- syscall (54, FreeBSD ELF64, sys_ioctl), rip = 0x8011e8c8a, rsp =  
> 0x7fffffffe2f8, rbp = 0x7fffffffe310 --
> db>
>
> -Matthew

I'm suspecting that ieee80211_tx_complete() eats one extra reference to the
vap->iv_bss - try to add ieee80211_node_incref(vap->iv_bss);
before urtwn_tx_start() (this is not a proper solution, but should work
for now).