panic in rt2860_drain_stats_fifo()

Hi,

I've got hit by this panic numerous times over the last few months.
I've tried to debug it, but I couldn't figure out what the issue was.
It is not reproducible, sometimes the machine will work correctly for
weeks, sometimes it will happen within a few hours after a reboot.

See the attached file for the backtrace and some debugging information.

The issue is that "ni->ni_vap" is 0xdeadcode.  But
"ic->ic_node_alloc()" is only called from ieee80211_alloc_node() and
ieee80211_tmp_node() which both seem to initialize "ni_vap" correctly,
which means the bad value comes from higher in the stack but I
couldn't figure out where.
-- 
Jeremie Le Hen
jlh_at_FreeBSD.org