diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath_ahb.c madwifi-ng-refcount-r2313-20070505.dev/ath/if_ath_ahb.c
--- madwifi-ng-refcount-r2313-20070505.old/ath/if_ath_ahb.c	2007-03-08 20:59:06.000000000 +0100
+++ madwifi-ng-refcount-r2313-20070505.dev/ath/if_ath_ahb.c	2007-05-13 18:17:56.367999800 +0200
@@ -274,12 +274,12 @@
 }
 
 
+
 static int
-exit_ath_wmac(u_int16_t wlanNum)
+exit_ath_wmac(u_int16_t wlanNum, struct ar531x_config *config)
 {
 	struct ath_ahb_softc *sc = sclist[wlanNum];
 	struct net_device *dev;
-	const char *sysType;
 	u_int16_t devid;        
 
 	if (sc == NULL)
@@ -289,13 +289,17 @@
 	ath_detach(dev);
 	if (dev->irq)
 		free_irq(dev->irq, dev);
-	sysType = get_system_type();
-	if (!strcmp(sysType, "Atheros AR5315"))
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,19)
+	devid = (u32) config->tag;
+#else
+	if (!strcmp(get_system_type(), "Atheros AR5315"))
 		devid = (u_int16_t) (sysRegRead(AR5315_SREV) &
 			(AR5315_REV_MAJ_M | AR5315_REV_MIN_M));
 	else
 		devid = (u_int16_t) ((sysRegRead(AR531X_REV) >> 8) & 
 			(AR531X_REV_MAJ | AR531X_REV_MIN));
+#endif
   
 	ahb_disable_wmac(devid, wlanNum);
 	free_netdev(dev);
@@ -401,7 +405,7 @@
 
 static int ahb_wmac_remove(struct platform_device *pdev)
 {
-	exit_ath_wmac(pdev->id);
+	exit_ath_wmac(pdev->id, (struct ar531x_config *) pdev->dev.platform_data);
 
 	return 0;
 }
@@ -439,7 +443,7 @@
 			(AR5315_REV_MAJ_M | AR5315_REV_MIN_M));
 		if (((devid & AR5315_REV_MAJ_M) == AR5315_REV_MAJ) ||
 			((devid & AR5315_REV_MAJ_M) == AR5317_REV_MAJ))
-			return init_ath_wmac(devid, 0, &config);
+			return init_ath_wmac(devid, 0);
 	}
 
 	devid = (u_int16_t) ((sysRegRead(AR531X_REV) >>8) &
@@ -452,11 +456,11 @@
 		ar5312BspEepromRead(2 * AR531X_RADIO_MASK_OFF, 2,
 			(char *) &radioMask);
 		if ((radioMask & AR531X_RADIO0_MASK) != 0)
-			if ((ret = init_ath_wmac(devid, 0, &config)) !=0 )
+			if ((ret = init_ath_wmac(devid, 0)) !=0 )
 				return ret;
 		/* XXX: Fall through?! */
 	case AR5212_AR2313_REV8:
-		if ((ret = init_ath_wmac(devid, 1, &config)) != 0)
+		if ((ret = init_ath_wmac(devid, 1)) != 0)
 			return ret;
 		break;
 	default:
diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcount-r2313-20070505.dev/ath/if_ath.c
--- madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c	2007-05-13 18:17:56.362000712 +0200
+++ madwifi-ng-refcount-r2313-20070505.dev/ath/if_ath.c	2007-05-13 18:17:56.371999192 +0200
@@ -7670,9 +7672,24 @@
 		DPRINTF(sc, ATH_DEBUG_RESET, "%s: beacon queue 0x%x\n",
 			__func__, ath_hal_gettxbuf(ah, sc->sc_bhalq));
 		for (i = 0; i < HAL_NUM_TX_QUEUES; i++)
-			if (ATH_TXQ_SETUP(sc, i))
+			if (ATH_TXQ_SETUP(sc, i)) {
 				ath_tx_stopdma(sc, &sc->sc_txq[i]);
+
+				/* The TxDMA may not really be stopped.
+				 * Double check the hal tx pending count */
+				npend += ath_hal_numtxpending(ah, sc->sc_txq[i].axq_qnum);
+			}
+	}
+	
+	if (npend) {
+		HAL_STATUS status;
+
+		/* TxDMA not stopped, reset the hal */
+		DPRINTF(sc, ATH_DEBUG_RESET, "%s: Unable to stop TxDMA. Reset HAL!\n", __func__);
+		if (!ath_hal_reset(ah, sc->sc_ic.ic_opmode, &sc->sc_curchan, AH_TRUE, &status))
+			printk("%s: unable to reset hardware; hal status %u\n", __func__, status);
 	}
+
 	sc->sc_dev->trans_start = jiffies;
 	netif_start_queue(sc->sc_dev);		/* XXX move to callers */
 	for (i = 0; i < HAL_NUM_TX_QUEUES; i++)