wlan_crypt_tkip panic

[Joe Talbott <josepht@xxxxxxxxxx>]

Hey guys,

It seems I've either munged the iwn driver I'm working on or I'm
genuinely hitting an edge case in the TKIP code.  I got the following
panic.  I'm attaching a tarball of the source directory and can
include patches from the unaltered FreeBSD source if needed.

My main concerns regarding the wifi driver porting in general is my
weak understanding of the mbuf handling code and the bus_dma* code.

Any ideas are appreciated.

Unread portion of the kernel message buffer:
panic: not enough data, data_len 3 space 2

Trace beginning at frame 0xd801c9b4
panic(ffffffff) at panic+0x8e
panic(c0609324,3,2,db20f500,5f0873f1) at panic+0x8e
michael_mic(1a,3,d801ca2c,c465dff8,d7d682b8) at michael_mic+0x455
tkip_enmic(d7d6b784,db210000,0) at tkip_enmic+0xb5
ieee80211_encap(d7dbb9c0,d7d6b6b8,db20bd00,d7dbb9c0,d7d682b8) at
ieee80211_encap+0x863
ieee80211_start(c48d8198,1,0,1,0) at ieee80211_start+0x657
ifq_dispatch(c48d8198,db20bd00,d801cb38) at ifq_dispatch+0x13a
ether_output_frame(c48d8198,db20bd00,db20bd9a,db20bd9a,0) at
ether_output_frame+0x1be
ether_output(c48d8198,db20bd00,c4549570,c46ef940,14) at
ether_output+0x29b
ieee80211_output(c48d8198,db20bd00,c4549570,c46ef940,0) at
ieee80211_output+0x2f
ip_output(db20bd00,0,d7c20104,10000,0) at ip_output+0xbc1
tcp_output(d7c20188,41eb68,0,db41eb68,1) at tcp_output+0x1449
tcp_usr_send(d7b616e0,0,c47b8700,0,0) at tcp_usr_send+0x1d3
netmsg_pru_send(db41eb68,c0714958,c0714958,d801cd84,c03def13) at
netmsg_pru_send+0x1c
netmsg_service(db41eb68,1,0,c0714440,ff800000) at netmsg_service+0x58
tcpmsg_service_loop(0,0,0,0,0) at tcpmsg_service_loop+0x1d
lwkt_exit() at lwkt_exit