Panic in ieee80211 tx mgmt timeout

Hi,

is this a known issue?

My -CURRENT system (r223560M, amd64, 8GB, Atheros WLAN) panics after
minutes to hours of uptime with the following message:

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 0
fault virtual address   = 0xffffff807f502000
fault code              = supervisor data read, page not present
...
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 11 (swi4: clock)
[ thread pid 11 tid 1000012 ]
Stopped at      ieee80211_tx_mgmt_timeout+0x1:  movq     (%rdi),%rdi

db> bt
Tracing pid 11 tid 100012 td 0xfffffe00032e0000
ieee80211_tx_mgmt_timeout() at ieee80211_tx_mgmt_timeout+0x1
intr_event_execute_handlers() at intr_event_execute_handlers+0x66
ithread_loop() at ithread_loop+0x96
fork_exit() at fork_exit+0x11d
fork_trampoline() at fork_trampoline+0xe
--- trap 0, rip = 0, rsp = 0xffffff8000288d00, rbp = 0 ---

This panic message is manually transcribed, since the GPT-only
partitioning prevents dumping of a kernel core. (Why, BTW?)
I could add a swap partition on a MBR disk, if a core dump seems
neccessary to diagnose the problem. I'm also willing to wait for that
panic to occur again and to gather more debug output.


Other information: The Atheros WLAN in this system is unused (not
associated) but both ath0 and wlan0 were "UP" at the time of the panic.

Initial testing shows the system to be stable with both wlan0 and ath0
set to "down" after boot. But still, the timeout should not panic the
kernel, if WLAN is active but not fully configured (e.g. no SSID).

Any ideas?

Best regards, STefan