Kernel crash on interface: run0

ugen4.2: <Ralink> at usbus4
run0: <1.0> on usbus4
run0: MAC/BBP RT3070 (rev 0x0201), RF RT2020 (MIMO 1T1R), address 68:7f:74:63:c8:fc
run0: firmware RT2870 loaded

FreeBSD fbsd 9.0-RELEASE FreeBSD 9.0-RELEASE #0: Tue Jan  3 07:15:25 UTC 2012     
[email]root@obrian.cse.buffalo.edu[/email]:/usr/obj/usr/src/sys/GENERIC  i386

panic: page fault

GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd"...

Unread portion of the kernel message buffer:


Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address   = 0x10003
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc08d3c22
stack pointer           = 0x28:0xc52d6bf8
frame pointer           = 0x28:0xc52d6c38
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 15 (usbus4)
trap number             = 12
panic: page fault
cpuid = 1
KDB: stack backtrace:
#0 0xc0a4b157 at kdb_backtrace+0x47
#1 0xc0a186b7 at panic+0x117
#2 0xc0d48cf3 at trap_fatal+0x323
#3 0xc0d48dad at trap_pfault+0xad
#4 0xc0d49b35 at trap+0x465
#5 0xc0d32a8c at calltrap+0x6
#6 0xc08d3f63 at run_bulk_tx_callback0+0x13
#7 0xc08c14b2 at usbd_callback_wrapper+0x722
#8 0xc08bd7ec at usb_command_wrapper+0xdc
#9 0xc08c0374 at usb_callback_proc+0x104
#10 0xc08ba399 at usb_process+0xf9
#11 0xc09ea997 at fork_exit+0x97
#12 0xc0d32b04 at fork_trampoline+0x8
Uptime: 3m8s
Physical memory: 2029 MB
Dumping 211 MB: 196panic: bufwrite: buffer is not busy???
cpuid = 1
 180 164 148 132 116 100 84 68 52 36 20 4

diff --git a/dev/usb/wlan/if_run.c b/dev/usb/wlan/if_run.c
index 4def4bd..e52e1fd 100644
--- a/dev/usb/wlan/if_run.c
+++ b/dev/usb/wlan/if_run.c
[color="Blue"]@@ -2526,8 +2526,8 @@[/color] run_rx_frame(struct run_softc *sc, struct mbuf *m, uint32_t dmalen)
                struct run_rx_radiotap_header *tap = &sc->sc_rxtap;
 
                tap->wr_flags = 0;
[color="Red"]-               tap->wr_chan_freq = htole16(ic->ic_bsschan->ic_freq);
-               tap->wr_chan_flags = htole16(ic->ic_bsschan->ic_flags);[/color]
[color="Green"]+               tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
+               tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);[/color]
                tap->wr_antsignal = rssi;
                tap->wr_antenna = ant;
                tap->wr_dbm_antsignal = run_rssi2dbm(sc, rssi, ant);
[color="Blue"]@@ -2772,8 +2772,8 @@[/color] tr_setup:
 
                        tap->wt_flags = 0;
                        tap->wt_rate = rt2860_rates[data->ridx].rate;
[color="Red"]-                       tap->wt_chan_freq = htole16(vap->iv_bss->ni_chan->ic_freq);
-                       tap->wt_chan_flags = htole16(vap->iv_bss->ni_chan->ic_flags);[/color]
[color="Green"]+                       tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
+                       tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);[/color]
                        tap->wt_hwqueue = index;
                        if (le16toh(txwi->phy) & RT2860_PHY_SHPRE)
                                tap->wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;

runfw_load="YES"