+--- madwifi-ng-r2420-20070602.orig/ath/if_ath.c 2007-07-02 23:49:33.450710750 +0200
++++ madwifi-ng-r2420-20070602/ath/if_ath.c 2007-07-02 23:50:43.107064000 +0200
+@@ -8197,16 +8197,15 @@
+ wds_ni->ni_rates = vap->iv_bss->ni_rates;
+ /* Depending on the sequence of bringing up devices
+ * it's possible the rates of the root bss isn't
+- * filled yet.
+- */
+- if (vap->iv_ic->ic_newassoc != NULL &&
+- wds_ni->ni_rates.rs_nrates != 0) {
++ * filled yet. */
++ if ((vap->iv_ic->ic_newassoc != NULL) &&
++ (wds_ni->ni_rates.rs_nrates != 0)) {
+ /* Fill in the rates based on our own rates
+ * we rely on the rate selection mechanism
+- * to find out which rates actually work!
+- */
++ * to find out which rates actually work! */
+ vap->iv_ic->ic_newassoc(wds_ni, 1);
+ }
++ ieee80211_unref_node(&wds_ni);
+ }
+ break;
+ default:
+Index: madwifi-ng-r2420-20070602/net80211/ieee80211_output.c
+===================================================================
+--- madwifi-ng-r2420-20070602.orig/net80211/ieee80211_output.c 2007-07-02 23:49:31.574593500 +0200
++++ madwifi-ng-r2420-20070602/net80211/ieee80211_output.c 2007-07-02 23:50:37.462711250 +0200
+@@ -268,6 +268,7 @@
+ * We'll get the frame back when the time is right.
+ */
+ ieee80211_pwrsave(ni, skb);
++ ieee80211_unref_node(&ni);
+ return 0;
+ }
+
+@@ -282,7 +283,7 @@
+ vap->iv_xrvap->iv_sta_assoc) {
+ struct sk_buff *skb1;
+ ni = ieee80211_find_txnode(vap->iv_xrvap, eh->ether_dhost);
+- skb1 = skb_clone(skb,GFP_ATOMIC);
++ skb1 = skb_clone(skb, GFP_ATOMIC);
+ if (skb1) {
+ cb = (struct ieee80211_cb *) skb1->cb;
+ cb->ni = ni;
+Index: madwifi-ng-r2420-20070602/net80211/ieee80211_wireless.c
+===================================================================
+--- madwifi-ng-r2420-20070602.orig/net80211/ieee80211_wireless.c 2007-07-02 23:49:31.566593000 +0200
++++ madwifi-ng-r2420-20070602/net80211/ieee80211_wireless.c 2007-07-02 23:49:34.126753000 +0200
+@@ -1088,7 +1088,6 @@
+ /* locate a node, read its rssi, check if updated, convert to dBm */