From: Arend van Spriel <redacted>

In the transmit path the field seq_ctrl is filled in, but the fragment
number was not properly determined.

Reviewed-by: Roland Vossen <redacted>
Reviewed-by: Pieter-Paul Giesberts <redacted>
Signed-off-by: Franky Lin <redacted>
---
 drivers/staging/brcm80211/brcmsmac/main.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/staging/brcm80211/brcmsmac/main.c b/drivers/staging/brcm80211/brcmsmac/main.c
index 35fc8b0..c023b8b 100644
--- a/drivers/staging/brcm80211/brcmsmac/main.c
+++ b/drivers/staging/brcm80211/brcmsmac/main.c

@@ -7101,7 +7101,7 @@ brcms_c_d11hdrs_mac80211(struct brcms_c_info *wlc, struct ieee80211_hw *hw,
 				scb->seqnum[p->priority]++;
 
 			/* extract fragment number from frame first */
-			seq = le16_to_cpu(seq) & FRAGNUM_MASK;
+			seq = le16_to_cpu(h->seq_ctrl) & FRAGNUM_MASK;
 			seq |= (scb->seqnum[p->priority] << SEQNUM_SHIFT);
 			h->seq_ctrl = cpu_to_le16(seq);
 

-- 
1.7.1