ural(4) panic if debug.mpsafenet is set to 1

Hello.
I'm using ural(4) with wpa_supplicant. But on some modest-high traffic, it
panics like this:

ieee80211_free_node(...)
ural_txeof(...)
usb_transfer_complete(...)
ehci_softintr(...)
ehci_intr1(...)
ithread_loop(...)
fork_exit(...)
fork_trampoliine(...)

I was unable to dump core. (Don't know why. It just blocks after I type
'call doadump') And I could not reproduce this with debug.mpsafenet=0.
My machine is SMP with 2 cpus. (P3-650MHz)

Thanks.
Sangwoo Shim