802.11n support for iwm(4): problem with separate BA task

I'm working on adding 802.11n support for iwm(4), currently AMPDU Rx and
MCS0-15 are working, results are the following:
https://people.freebsd.org/~misha/iwm1.jpeg

While hardware interaction works fine, I found it problematic to handle
reboots. My code is based on OpenBSD patch[1], and as in the patch I use
separate task for ADDBA/DELBA handling. Every time I get those frames I
enqueue a task to synchronously handle it within firmware.

The problem is that when I do a reboot I get a panic - I receive a DELBA
request, enqueue a task to handle it, but when the code finally firing
the iwm_node is already 0xdeadc0de'd.

I've tried checking for IWM_FLAG_STOPPED flag, canceling the task in
ANY->INIT state transition and in vap_delete method, but still get the
panic.

I've taken a look at iwn(4) driver and how it handles ADDBA/DELBA - and
it handles it in async manner, meaning that we just send needed commands
to the hardware and don't check the answer.

Is iwn(4) way of doing thing is the right way to do it? Or maybe someone
can prompt me how to properly handle DELBA request in sync mode?

[1] - https://github.com/openbsd/src/commit/d1ea7b2160ed2eb0df49e1e2db31cabcceb666cb