Index: broadcom-wl-4.150.10.5.2/router/shared/linux_timer.c
===================================================================
--- broadcom-wl-4.150.10.5.2.orig/router/shared/linux_timer.c	2008-04-07 00:15:24.914329846 +0200
+++ broadcom-wl-4.150.10.5.2/router/shared/linux_timer.c	2008-04-07 00:14:52.288470602 +0200
@@ -94,6 +94,7 @@
 #define TFLAG_NONE	0
 #define TFLAG_CANCELLED	(1<<0)
 #define TFLAG_DELETED	(1<<1)
+#define TFLAG_QUEUED	(1<<2)
 
 struct event {
     struct timeval it_interval;
@@ -207,6 +208,7 @@
 
 	event_freelist = event->next;
 	event->next = NULL;
+	event->flags &= ~TFLAG_QUEUED;
 
 	check_event_queue();
 
@@ -387,6 +389,7 @@
 	}
 
 	event->flags &= ~TFLAG_CANCELLED;
+	event->flags |= TFLAG_QUEUED;
 
 	unblock_timer();
 
@@ -502,7 +505,15 @@
 		(*(event->func))((timer_t) event, (int)event->arg);
 
 		/* If the event has been cancelled, do NOT put it back on the queue. */
-		if (!(event->flags & TFLAG_CANCELLED)) {
+		/* Check for TFLAG_QUEUED is to avoid pathologic case, when after
+		 * dequeueing event handler deletes its own timer and allocates new one
+		 * which (at least in some cases) gets the same pointer and thus its
+		 * 'flags' will be rewritten, most notably TFLAG_CANCELLED, and, to
+		 * complete the disaster, it will be queued. alarm_handler tries to
+		 * enqueue 'event' (which is on the same memory position as newly
+		 * allocated timer), which results in queueing the same pointer once
+		 * more. And this way, loop in event queue is created. */
+		if ( !(event->flags & TFLAG_CANCELLED) && !(event->flags & TFLAG_QUEUED) ) {
 
 			/* if the event is a recurring event, reset the timer and
 			 * find its correct place in the sorted list of events.
@@ -545,6 +556,7 @@
 				/* link our new event into the pending event queue. */
 				event->next = *ppevent;
 				*ppevent = event;
+				event->flags |= TFLAG_QUEUED;
 			} else {
 				/* there is no interval, so recycle the event structure.
 				 * timer_delete((timer_t) event);