console freeze after "ifconfig wlan0 scan" with wi(4) pccard device

On amd64 r217010 laptop (HP Compaq 6715s)
I'm trying to use this wi(4) device:

wi0: <The Linksys Group, Inc. Instant Wireless Network PC Card>
 at port 0x100-0x13f irq 20 function 0 config 1 on pccard0

I do

# ifconfig wlan0 create wlandev wi0
# ifconfig -a
bge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=8009b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,LINKSTAT
E>
        ether 00:1a:4b:89:4b:4e
        inet 192.168.1.102 netmask 0xffffff00 broadcast 192.168.1.255
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
        options=3<RXCSUM,TXCSUM>
        inet 127.0.0.1 netmask 0xff000000
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x8
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
wi0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 2290
        ether 00:06:25:10:56:3b
        media: IEEE 802.11 Wireless Ethernet autoselect (autoselect)
        status: no carrier
wlan0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 00:06:25:10:56:3b
        media: IEEE 802.11 Wireless Ethernet autoselect (autoselect)
        status: no carrier
        ssid "" channel 1 (2412 MHz 11b)
        country US authmode OPEN privacy OFF txpower 0 bmiss 7 scanvalid 60
        bintval 0

But after

# ifconfig wlan0 up scan

I get console freeze requiring cold reboot.
No panic, just a LOR:

 wi0: <The Linksys Group, Inc. Instant Wireless Network PC Card> at port 0x100-0x13f irq 20 function 0 config 1 on pccard0
 wlan0: Ethernet address: 00:06:25:10:56:3b
 lock order reversal:
 1st 0xffffff80012be018 wi0_com_lock (wi0_com_lock) _at_ /usr/src/sys/net80211/ieee80211_scan.c:806
 2nd 0xfffffe0001b8d010 wi0 (network driver) _at_ /usr/src/sys/dev/wi/if_wi.c:1083
 KDB: stack backtrace:
 db_trace_self_wrapper() at db_trace_self_wrapper+0x2a
 kdb_backtrace() at kdb_backtrace+0x37
 _witness_debugger() at _witness_debugger+0x2e
 witness_checkorder() at witness_checkorder+0x807
 _mtx_lock_flags() at _mtx_lock_flags+0x79
 wi_raw_xmit() at wi_raw_xmit+0x68
 ieee80211_send_probereq() at ieee80211_send_probereq+0x3f7
 scan_curchan() at scan_curchan+0x49
 scan_task() at scan_task+0x2d5
 taskqueue_run_locked() at taskqueue_run_locked+0x93
 taskqueue_thread_loop() at taskqueue_thread_loop+0x3f
 fork_exit() at fork_exit+0x12a
 fork_trampoline() at fork_trampoline+0xe
 --- trap 0, rip = 0, rsp = 0xffffff80d401ad00, rbp = 0 ---


In case it matters I've

hw.cbb.start_memory="0xf4800000"

in /boot/loader.conf, according to
http://www.freebsd.org/cgi/query-pr.cgi?pr=115623


Please advise

many thanks
anton

-- 
Anton Shterenlikht
Room 2.6, Queen's Building
Mech Eng Dept
Bristol University
University Walk, Bristol BS8 1TR, UK
Tel: +44 (0)117 331 5944
Fax: +44 (0)117 929 4423