diff -urN madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_node.c madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_node.c
--- madwifi-ng-refcount-r2313-20070505.old/net80211/ieee80211_node.c	2007-05-04 23:09:29.000000000 +0200
+++ madwifi-ng-refcount-r2313-20070505.dev/net80211/ieee80211_node.c	2007-05-13 18:17:55.697101792 +0200
@@ -981,11 +981,11 @@
 ieee80211_del_wds_node(struct ieee80211_node_table *nt, struct ieee80211_node *ni)
 {
 	int hash;
-	struct ieee80211_wds_addr *wds;
+	struct ieee80211_wds_addr *wds, *next;
 
 	IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
 	for (hash = 0; hash < IEEE80211_NODE_HASHSIZE; hash++) {
-		LIST_FOREACH(wds, &nt->nt_wds_hash[hash], wds_hash) {
+		LIST_FOREACH_SAFE(wds, &nt->nt_wds_hash[hash], wds_hash, next) {
 			if (wds->wds_ni == ni) {
 				LIST_REMOVE(wds, wds_hash);
 				ieee80211_unref_node(&wds->wds_ni);
@@ -1002,11 +1002,11 @@
 {
 	struct ieee80211_node_table *nt = (struct ieee80211_node_table *)data;
 	int hash;
-	struct ieee80211_wds_addr *wds;
+	struct ieee80211_wds_addr *wds, *next;
 
 	IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
 	for (hash = 0; hash < IEEE80211_NODE_HASHSIZE; hash++) {
-		LIST_FOREACH(wds, &nt->nt_wds_hash[hash], wds_hash) {
+		LIST_FOREACH_SAFE(wds, &nt->nt_wds_hash[hash], wds_hash, next) {
 			if (wds->wds_agingcount != WDS_AGING_STATIC) {
 				if (!wds->wds_agingcount) {
 					LIST_REMOVE(wds, wds_hash);