if (ni != NULL && ni != ic->ic_bss)  ieee80211_free_node(ic, ni);
if (ni != NULL) ieee80211_release_node(ic, ni);
atu_start(struct ifnet *ifp){	struct atu_softc	*sc = ifp->if_softc;	struct ieee80211com	*ic = &sc->sc_ic;	struct atu_cdata	*cd = &sc->atu_cdata;	struct ieee80211_node	*ni;	struct ieee80211_frame	*wh;	struct atu_chain	*c;	struct mbuf		*m = NULL;	int			s;	DPRINTFN(25, ("%s: atu_start: enter\n", USBDEVNAME(sc->atu_dev)));	s = splnet();	if (ifp->if_flags & IFF_OACTIVE) {		DPRINTFN(30, ("%s: atu_start: IFF_OACTIVE\n",		    USBDEVNAME(sc->atu_dev)));		splx(s);		return;	}	for (;;) {		/* grab a TX buffer */		s = splnet();		c = SLIST_FIRST(&cd->atu_tx_free);		if (c != NULL) {			SLIST_REMOVE_HEAD(&cd->atu_tx_free, atu_list);			cd->atu_tx_inuse++;			if (cd->atu_tx_inuse == ATU_TX_LIST_CNT)				ifp->if_flags |= IFF_OACTIVE;		}		splx(s);		if (c == NULL) {			DPRINTFN(10, ("%s: out of tx xfers\n",			    USBDEVNAME(sc->atu_dev)));			ifp->if_flags |= IFF_OACTIVE;			break;		}		/*		 * Poll the management queue for frames, it has priority over		 * normal data frames.		 */		IF_DEQUEUE(&ic->ic_mgtq, m);		if (m == NULL) {			DPRINTFN(10, ("%s: atu_start: data packet\n",			    USBDEVNAME(sc->atu_dev)));			if (ic->ic_state != IEEE80211_S_RUN) {				DPRINTFN(25, ("%s: no data till running\n",				    USBDEVNAME(sc->atu_dev)));				/* put the xfer back on the list */				s = splnet();				SLIST_INSERT_HEAD(&cd->atu_tx_free, c,				    atu_list);				cd->atu_tx_inuse--;				splx(s);				break;			}			IF_DEQUEUE(&ifp->if_snd, m);			if (m == NULL) {				DPRINTFN(25, ("%s: nothing to send\n",				    USBDEVNAME(sc->atu_dev)));				s = splnet();				SLIST_INSERT_HEAD(&cd->atu_tx_free, c,				    atu_list);				cd->atu_tx_inuse--;				splx(s);				break;			}			/* XXX bpf listener goes here */			m = ieee80211_encap(ifp, m, &ni);			if (m == NULL)				goto bad;			wh = mtod(m, struct ieee80211_frame *);		} else {			DPRINTFN(25, ("%s: atu_start: mgmt packet\n",			    USBDEVNAME(sc->atu_dev)));			/*			 * Hack!  The referenced node pointer is in the			 * rcvif field of the packet header.  This is			 * placed there by ieee80211_mgmt_output because			 * we need to hold the reference with the frame			 * and there's no other way (other than packet			 * tags which we consider too expensive to use)			 * to pass it along.			 */			ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;			m->m_pkthdr.rcvif = NULL;			wh = mtod(m, struct ieee80211_frame *);			/* sc->sc_stats.ast_tx_mgmt++; */		}		if (atu_tx_start(sc, ni, c, m)) {bad:			s = splnet();			SLIST_INSERT_HEAD(&cd->atu_tx_free, c,			    atu_list);			cd->atu_tx_inuse--;			splx(s);			/* ifp_if_oerrors++; */			if (ni != NULL && ni != ic->ic_bss)				/* reclaim node */				ieee80211_free_node(ic, ni);			continue;		}		ifp->if_timer = 5;	}}