Index: madwifi-trunk-r3314/ath/if_ath.c
===================================================================
--- madwifi-trunk-r3314.orig/ath/if_ath.c	2008-02-20 18:10:52.499506168 +0100
+++ madwifi-trunk-r3314/ath/if_ath.c	2008-02-20 18:10:52.731519391 +0100
@@ -3315,17 +3315,18 @@
 	 * without affecting any other bridge ports. */
 	if (skb_cloned(skb)) {
 		/* Remember the original SKB so we can free up our references */
-		struct sk_buff *skb_orig = skb;
-		skb = skb_copy(skb, GFP_ATOMIC);
-		if (skb == NULL) {
+		struct sk_buff *skb_new;
+		skb_new = skb_copy(skb, GFP_ATOMIC);
+		if (skb_new == NULL) {
 			DPRINTF(sc, ATH_DEBUG_XMIT,
 				"Dropping; skb_copy failure.\n");
 			/* No free RAM, do not requeue! */
 			goto hardstart_fail;
 		}
-		ieee80211_skb_copy_noderef(skb_orig, skb);
-		ieee80211_dev_kfree_skb(&skb_orig);
-	} 
+		ieee80211_skb_copy_noderef(skb, skb_new);
+		ieee80211_dev_kfree_skb(&skb);
+		skb = skb_new;
+	}
 	eh = (struct ether_header *)skb->data;
 
 #ifdef ATH_SUPERG_FF
@@ -3596,6 +3597,8 @@
 	sc->sc_stats.ast_tx_mgmt++;
 	return 0;
 bad:
+	if (skb)
+		ieee80211_dev_kfree_skb(&skb);
 	ath_return_txbuf(sc, &bf);
 	return error;
 }