From 52d75a271fdca7ebfa79e400082f747105c5d4cf Mon Sep 17 00:00:00 2001
From: Coleman Kane <cokane@FreeBSD.org>
Date: Tue, 22 Sep 2009 12:36:51 +0000
Subject: [PATCH] The ndis_scan function may be started after ndis vap have
 been destroyed

PR:		kern/138632
Submitted by:	Paul B. Mahol <onemda at gmail.com>
MFC after:	3 days
---
 sys/dev/if_ndis/if_ndis.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/sys/dev/if_ndis/if_ndis.c b/sys/dev/if_ndis/if_ndis.c
index cd2397203999..b153e651472b 100644
--- a/sys/dev/if_ndis/if_ndis.c
+++ b/sys/dev/if_ndis/if_ndis.c
@@ -1012,7 +1012,12 @@ static void
 ndis_vap_delete(struct ieee80211vap *vap)
 {
 	struct ndis_vap *nvp = NDIS_VAP(vap);
+	struct ieee80211com *ic = vap->iv_ic;
+	struct ifnet *ifp = ic->ic_ifp;
+	struct ndis_softc *sc = ifp->if_softc;
 
+	ndis_stop(sc);
+	callout_drain(&sc->ndis_scan_callout);
 	ieee80211_vap_detach(vap);
 	free(nvp, M_80211_VAP);
 }