Reproducible if_wpi panic "not enough data, data_len 2 space 1" on FreeBSD 9-CURRENT with WPA

[Lawrence Stewart]

Hi All,

I have an Intel 3945ABG in my Toshiba R600 laptop which fairly reliably 
panics a while after I associate it with a WPA AP. It will happily 
associate and pass packets for some time (10's of minutes) and then 
panic. I have managed to trigger it both times I've tried to associate 
with this particular AP (some sort of NetGear 802.11n capable unit).

Plenty of details here:

http://people.freebsd.org/~lstewart/misc/wpi_debug/core.txt
http://people.freebsd.org/~lstewart/misc/wpi_debug/kgdb_output.txt

My /etc/wpa_supplicant.conf:

##########
ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=wheel
network={
         ssid="X"
         proto=WPA
         psk="Y"
}
##########


Suggestions most welcome. In particular, the comment above the KASSERT 
that is firing in frame 10 seems to indicate that some prodding at the 
logic in the michael_mic() function may be required.


Cheers,
Lawrence