Trigerring a taskqueue from the if_start routine crashes FreeBSD6

[Sebastien]

Hello,

My 802.11 driver queues frames to send to the device in a tailq and then 
triggers a taskqueue to actually send them. The taskqueue is required because 
I need to do two USB transfers, and wait for the first one to complete before 
I start the second : doing this asynchronously would be a pain.

This used to work fine under FreeBSD 5, but with 6, the system randomly 
freezes without any error message, and doesn't respond to anything else than 
the big red button. The crash seems more likely to happen when there are 3 or 
more frames in the tailq when the taskqueue runs.

My code is online at 
http://svnweb.tuxfamily.org/listing.php?repname=p54u+%28prism54%29&path=%2F&sc=0

The taskqueue-related code is all in output_layer.c, and the interface with 
the 802.11 and network stack, from which the taskqueue is triggered, is in 
netif.c.

The taskqueue is also trigerred from the thread created to bring the device up 
when it's detected, but it doesn't crash there (but the frames are queued one 
by one there).

Any ideas ?

Thanks,
Sebastien