Tom Hughes wrote:

Commit 3a2923e83c introduced a bug when a corrupt descriptor
is encountered - although the following descriptor is discarded
and returned to the queue for reuse the associated frame is
also returned for processing. This leads to a panic:

BUG: unable to handle kernel NULL pointer dereference at 000000000000003a

John, can you queue this regression fix for 3.5 ? And the patch that fixes a
WEP regression is required too (bed3d9c0b71f9afbfec905cb6db3b9f16be29d4d).

thanks,
Sujith