Index: madwifi-ng-r2420-20070602/ath/if_ath.c
===================================================================
--- madwifi-ng-r2420-20070602.orig/ath/if_ath.c	2007-06-04 13:21:58.427094400 +0200
+++ madwifi-ng-r2420-20070602/ath/if_ath.c	2007-06-04 13:21:58.684055336 +0200
@@ -2554,7 +2554,7 @@
 	/* NB: use this lock to protect an->an_ff_txbuf in athff_can_aggregate()
 	 *     call too.
 	 */
-	ATH_TXQ_LOCK_IRQ(txq);
+	ATH_TXQ_LOCK_BH(txq);
 	if (athff_can_aggregate(sc, eh, an, skb, vap->iv_fragthreshold, &ff_flush)) {
 		if (an->an_tx_ffbuf[skb->priority]) { /* i.e., frame on the staging queue */
 			bf = an->an_tx_ffbuf[skb->priority];
@@ -2562,6 +2562,7 @@
 			/* get (and remove) the frame from staging queue */
 			TAILQ_REMOVE(&txq->axq_stageq, bf, bf_stagelist);
 			an->an_tx_ffbuf[skb->priority] = NULL;
+			ATH_TXQ_UNLOCK_BH(txq);
 
 			/*
 			 * chain skbs and add FF magic
@@ -2584,7 +2585,7 @@
 			 */
 			ATH_HARDSTART_GET_TX_BUF_WITH_LOCK;
 			if (bf == NULL) {
-				ATH_TXQ_UNLOCK_IRQ_EARLY(txq);
+				ATH_TXQ_UNLOCK_BH(txq);
 				goto hardstart_fail;
 			}
 			DPRINTF(sc, ATH_DEBUG_XMIT | ATH_DEBUG_FF,
@@ -2596,8 +2597,7 @@
 			an->an_tx_ffbuf[skb->priority] = bf;
 
 			TAILQ_INSERT_HEAD(&txq->axq_stageq, bf, bf_stagelist);
-
-			ATH_TXQ_UNLOCK_IRQ_EARLY(txq);
+			ATH_TXQ_UNLOCK_BH(txq);
 
 			return 0;
 		}
@@ -2649,12 +2649,12 @@
 
 		ATH_HARDSTART_GET_TX_BUF_WITH_LOCK;
 		if (bf == NULL) {
-			ATH_TXQ_UNLOCK_IRQ_EARLY(txq);
+			ATH_TXQ_UNLOCK_BH(txq);
 			goto hardstart_fail;
 		}
+		ATH_TXQ_UNLOCK_BH(txq);
 	}
 
-	ATH_TXQ_UNLOCK_IRQ(txq);
 
 ff_bypass:
 
Index: madwifi-ng-r2420-20070602/ath/if_athvar.h
===================================================================
--- madwifi-ng-r2420-20070602.orig/ath/if_athvar.h	2007-06-04 13:21:58.428094248 +0200
+++ madwifi-ng-r2420-20070602/ath/if_athvar.h	2007-06-04 13:21:58.684055336 +0200
@@ -484,6 +484,8 @@
 #define ATH_TXQ_INTR_PERIOD		5  /* axq_intrcnt period for intr gen */
 #define	ATH_TXQ_LOCK_INIT(_tq)		spin_lock_init(&(_tq)->axq_lock)
 #define	ATH_TXQ_LOCK_DESTROY(_tq)
+#define ATH_TXQ_LOCK_BH(_tq)		spin_lock_bh(&(_tq)->axq_lock);
+#define ATH_TXQ_UNLOCK_BH(_tq)		spin_unlock_bh(&(_tq)->axq_lock);
 #define ATH_TXQ_LOCK_IRQ(_tq)		do {				\
 	unsigned long __axq_lockflags;					\
 	spin_lock_irqsave(&(_tq)->axq_lock, __axq_lockflags);