--- /dev/null
+diff -ur madwifi.old/ath/if_ath.c madwifi.dev/ath/if_ath.c
+--- madwifi.old/ath/if_ath.c 2007-06-01 16:44:25.170898128 +0200
++++ madwifi.dev/ath/if_ath.c 2007-06-01 20:01:24.205131816 +0200
+@@ -2555,7 +2555,7 @@
+ /* NB: use this lock to protect an->an_ff_txbuf in athff_can_aggregate()
+ * call too.
+ */
+- ATH_TXQ_LOCK_IRQ(txq);
++ ATH_TXQ_LOCK_BH(txq);
+ if (athff_can_aggregate(sc, eh, an, skb, vap->iv_fragthreshold, &ff_flush)) {
+ if (an->an_tx_ffbuf[skb->priority]) { /* i.e., frame on the staging queue */
+ bf = an->an_tx_ffbuf[skb->priority];
+@@ -2563,6 +2563,7 @@
+ /* get (and remove) the frame from staging queue */
+ TAILQ_REMOVE(&txq->axq_stageq, bf, bf_stagelist);
+ an->an_tx_ffbuf[skb->priority] = NULL;
++ ATH_TXQ_UNLOCK_BH(txq);
+
+ /*
+ * chain skbs and add FF magic
+@@ -2585,7 +2586,7 @@
+ */
+ ATH_HARDSTART_GET_TX_BUF_WITH_LOCK;
+ if (bf == NULL) {
+- ATH_TXQ_UNLOCK_IRQ_EARLY(txq);
++ ATH_TXQ_UNLOCK_BH(txq);
+ goto hardstart_fail;
+ }
+ DPRINTF(sc, ATH_DEBUG_XMIT | ATH_DEBUG_FF,
+@@ -2597,8 +2598,7 @@
+ an->an_tx_ffbuf[skb->priority] = bf;
+
+ TAILQ_INSERT_HEAD(&txq->axq_stageq, bf, bf_stagelist);
+-
+- ATH_TXQ_UNLOCK_IRQ_EARLY(txq);
++ ATH_TXQ_UNLOCK_BH(txq);
+
+ return 0;
+ }
+@@ -2650,12 +2650,12 @@
+
+ ATH_HARDSTART_GET_TX_BUF_WITH_LOCK;
+ if (bf == NULL) {
+- ATH_TXQ_UNLOCK_IRQ_EARLY(txq);
++ ATH_TXQ_UNLOCK_BH(txq);
+ goto hardstart_fail;
+ }
++ ATH_TXQ_UNLOCK_BH(txq);
+ }
+
+- ATH_TXQ_UNLOCK_IRQ(txq);
+
+ ff_bypass:
+
+diff -ur madwifi.old/ath/if_athvar.h madwifi.dev/ath/if_athvar.h
+--- madwifi.old/ath/if_athvar.h 2007-06-01 16:44:25.149901320 +0200
++++ madwifi.dev/ath/if_athvar.h 2007-06-01 20:00:06.916881416 +0200
+@@ -484,6 +484,8 @@
+ #define ATH_TXQ_INTR_PERIOD 5 /* axq_intrcnt period for intr gen */
+ #define ATH_TXQ_LOCK_INIT(_tq) spin_lock_init(&(_tq)->axq_lock)
+ #define ATH_TXQ_LOCK_DESTROY(_tq)
++#define ATH_TXQ_LOCK_BH(_tq) spin_lock_bh(&(_tq)->axq_lock);
++#define ATH_TXQ_UNLOCK_BH(_tq) spin_unlock_bh(&(_tq)->axq_lock);
+ #define ATH_TXQ_LOCK_IRQ(_tq) do { \
+ unsigned long __axq_lockflags; \
+ spin_lock_irqsave(&(_tq)->axq_lock, __axq_lockflags);
+