Hi, I found this code in ar9287_attach.c: in ar9287Attach() function. ahp9287 = ath_hal_malloc(sizeof (struct ath_hal_9287)); during detach they just freed (ath_hal) ah. I searched every where and cant find it. please let me know where ahp9287 is deallocated. Thanks and regards, vishnu