Don't call the miniport driver's releasepacket function unless the

packet being freed has NDIS_STATUS_PENDING in the status field of
the OOB data.  Finish implementing the "alternative" packet-releasing
function so it doesn't crash.

For those that are curious about ndis0: <ORiNOCO 802.11abg ComboCard Gold>:
1123 packets transmitted, 1120 packets received, 0% packet loss
round-trip min/avg/max/stddev = 3.837/6.146/13.919/1.925 ms

Not bad!

sys/compat/ndis/kern_ndis.c

@@ -81,6 +81,7 @@ __stdcall static void ndis_statusdone_func(ndis_handle);
 __stdcall static void ndis_setdone_func(ndis_handle, ndis_status);
 __stdcall static void ndis_getdone_func(ndis_handle, ndis_status);
 __stdcall static void ndis_resetdone_func(ndis_handle, ndis_status, uint8_t);
+static void ndis_free_packet_and_bufs(ndis_packet *);
 
 /*
  * This allows us to export our symbols to other modules.
@@ -327,6 +328,38 @@ ndis_flush_sysctls(arg)
 	return(0);
 }
 
+void
+ndis_free_bufs(b0)
+	ndis_buffer		*b0;
+{
+	ndis_buffer		*next;
+
+	if (b0 == NULL)
+		return;
+
+	while(b0 != NULL) {
+		next = b0->nb_next;
+		ndis_free_buf(b0);
+		b0 = next;
+	}
+
+	return;
+}
+
+static void
+ndis_free_packet_and_bufs(p)
+	ndis_packet		*p;
+{
+	if (p == NULL)
+		return;
+
+	ndis_free_bufs(p->np_private.npp_head);
+	p->np_private.npp_head = NULL;
+	ndis_free_packet(p);
+
+	return;
+}
+
 void
 ndis_return_packet(buf, arg)
 	void			*buf;	/* not used */
@@ -352,44 +385,13 @@ ndis_return_packet(buf, arg)
 	sc = p->np_softc;
 	returnfunc = sc->ndis_chars.nmc_return_packet_func;
 	adapter = sc->ndis_block.nmb_miniportadapterctx;
-	if (returnfunc == NULL)
-		ndis_free_packet(p);
+	if (returnfunc == NULL || p->np_oob.npo_status != NDIS_STATUS_PENDING)
+		ndis_free_packet_and_bufs(p);
 	else
 		returnfunc(adapter, p);
 	return;
 }
 
-void
-ndis_free_bufs(b0)
-	ndis_buffer		*b0;
-{
-	ndis_buffer		*next;
-
-	if (b0 == NULL)
-		return;
-
-	while(b0 != NULL) {
-		next = b0->nb_next;
-		free (b0, M_DEVBUF);
-		b0 = next;
-	}
-
-	return;
-}
-
-void
-ndis_free_packet(p)
-	ndis_packet		*p;
-{
-	if (p == NULL)
-		return;
-
-	ndis_free_bufs(p->np_private.npp_head);
-	free(p, M_DEVBUF);
-
-	return;
-}
-
 int
 ndis_convert_res(arg)
 	void			*arg;

sys/compat/ndis/ndis_var.h

@@ -1177,6 +1177,7 @@ extern int ndis_convert_res(void *);
 extern int ndis_alloc_amem(void *);
 extern void ndis_free_packet(ndis_packet *);
 extern void ndis_free_bufs(ndis_buffer *);
+extern void ndis_free_buf(ndis_buffer *);
 extern int ndis_reset_nic(void *);
 extern int ndis_halt_nic(void *);
 extern int ndis_shutdown_nic(void *);

sys/compat/ndis/subr_ndis.c

@@ -1477,8 +1477,8 @@ ndis_alloc_packet(status, packet, pool)
 	return;
 }
 
-__stdcall static void
-ndis_release_packet(packet)
+void
+ndis_free_packet(packet)
 	ndis_packet		*packet;
 {
 	ndis_packet		*head;
@@ -1497,6 +1497,14 @@ ndis_release_packet(packet)
 	return;
 }
 
+__stdcall static void
+ndis_release_packet(packet)
+	ndis_packet		*packet;
+{
+	ndis_free_packet(packet);
+	return;
+}	
+
 __stdcall static void
 ndis_unchain_headbuf(packet, buf)
 	ndis_packet		*packet;
@@ -1636,8 +1644,8 @@ ndis_alloc_buf(status, buffer, pool, vaddr, len)
 	return;
 }
 
-__stdcall static void
-ndis_release_buf(buf)
+void
+ndis_free_buf(buf)
 	ndis_buffer		*buf;
 {
 	ndis_buffer		*head;
@@ -1656,6 +1664,14 @@ ndis_release_buf(buf)
 	return;
 }
 
+__stdcall static void
+ndis_release_buf(buf)
+	ndis_buffer		*buf;
+{
+	ndis_free_buf(buf);
+	return;
+}
+
 /*
  * Get the virtual address and length of a buffer.
  * Note: the vaddr argument is optional.