ath driver panics on 6-STABLE (LOR)

I bought two atheros based card: a dlink DWL-G520 pci for my home
router (via c3) and a DWL-G650 pccard for my laptop. I use it with my
Netgear 802.11g Access Point.

I'm having repeatedly panics, which I can't reproduce (if not waiting
a few minutes or some hours of activity), especially on the
router. I've upgraded to the latest RELENG_6 yesterday from 6-BETA
without success. Finally built kernel with debug symbols. Here's the
backtrace:

sberta:/home/satu/debug> kgdb -d crash/ -n 0 kernel.debug
[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:
lock order reversal: (sleepable after non-sleepable)
 1st 0xc11cf188 ath0 (xmit q) _at_ /usr/src/sys/modules/ath/../../dev/ath/if_ath.c:3537
 2nd 0xc072ea24 user map (user map) _at_ /usr/src/sys/vm/vm_map.c:2997
KDB: stack backtrace:
kdb_backtrace(0,ffffffff,c073e260,c073f2c8,c070a14c) at kdb_backtrace+0x29
witness_checkorder(c072ea24,9,c06e2a28,bb5) at witness_checkorder+0x5b0
_sx_xlock(c072ea24,c06e2a28,bb5) at _sx_xlock+0x50
_vm_map_lock_read(c072e9e0,c06e2a28,bb5,1000016,c10d368c) at _vm_map_lock_read+0x37
vm_map_lookup(d83db930,0,1,d83db934,d83db924) at vm_map_lookup+0x28
vm_fault(c072e9e0,0,1,0,c10d4600) at vm_fault+0x65
trap_pfault(d83db9f8,0,10) at trap_pfault+0xce
trap(8,28,28,0,e04bdcdc) at trap+0x319
calltrap() at calltrap+0x5
--- trap 0xc, eip = 0xc088bf08, esp = 0xd83dba38, ebp = 0 ---
zz0e373a4d() at zz0e373a4d+0x68


Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x10
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc088bf08
stack pointer           = 0x28:0xd83dba38
frame pointer           = 0x28:0x0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 28 (swi4: clock sio)
trap number             = 12
panic: page fault
Uptime: 3m3s
Dumping 223 MB (2 chunks)
  chunk 0: 1MB (160 pages) ... ok
  chunk 1: 223MB (57072 pages) 207 191 175 159 143 127 111 95 79 63 47 31 15

#0  doadump () at pcpu.h:165
165     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) backtrace
#0  doadump () at pcpu.h:165
#1  0xc0519ed4 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:399
#2  0xc051a17f in panic (fmt=0xc06b50d4 "%s")
    at /usr/src/sys/kern/kern_shutdown.c:555
#3  0xc068d9a2 in trap_fatal (frame=0xd83db9f8, eva=16)
    at /usr/src/sys/i386/i386/trap.c:831
#4  0xc068d6d7 in trap_pfault (frame=0xd83db9f8, usermode=0, eva=16)
    at /usr/src/sys/i386/i386/trap.c:742
#5  0xc068d341 in trap (frame=
      {tf_fs = 8, tf_es = 40, tf_ds = 40, tf_edi = 0, tf_esi = -531899172, tf_ebp = 0, tf_isp = -667043292, tf_ebx = -531895256, tf_edx = 787639, tf_ecx = -1073479567, tf_eax = 1, tf_trapno = 12, tf_err = 0, tf_eip = -1064780024, tf_cs = 32, tf_eflags = 66050, tf_esp = 16824924, tf_ss = 0})
    at /usr/src/sys/i386/i386/trap.c:432
#6  0xc067d60a in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#7  0xc088bf08 in ?? ()
(kgdb) 


Let me know what further information I may provide.

Bye,
Dario

-- 
Dario Freni (saturnero_at_freesbie.org)
FreeSBIE developer (http://www.freesbie.org)
GPG Public key at http://www.saturnero.net/saturnero.asc