diff --git a/package/madwifi/patches/120-soc_fix.patch b/package/madwifi/patches/120-soc_fix.patch
index 4c37a9c17d..a7378299cd 100644
--- a/package/madwifi/patches/120-soc_fix.patch
+++ b/package/madwifi/patches/120-soc_fix.patch
@@ -71,48 +71,6 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath_ahb.c madwifi-ng-ref
 diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcount-r2313-20070505.dev/ath/if_ath.c
 --- madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c	2007-05-13 18:17:56.362000712 +0200
 +++ madwifi-ng-refcount-r2313-20070505.dev/ath/if_ath.c	2007-05-13 18:17:56.371999192 +0200
-@@ -2490,6 +2490,7 @@
- 		DPRINTF(sc,ATH_DEBUG_XMIT,				\
- 			"%s: discard, no xmit buf\n", __func__);	\
- 		sc->sc_stats.ast_tx_nobuf++;				\
-+		goto hardstart_fail;					\
- 	}
- 
- /*
-@@ -2676,14 +2677,13 @@
- 		else if (an->an_tx_ffbuf[skb->priority]) {
- 			DPRINTF(sc, ATH_DEBUG_XMIT | ATH_DEBUG_FF,
- 				"%s: Out-Of-Order fast-frame\n", __func__);
--			ATH_TXQ_UNLOCK(txq);
-+			ATH_TXQ_UNLOCK_BH(txq);
- 		} else
--			ATH_TXQ_UNLOCK(txq);
-+			ATH_TXQ_UNLOCK_BH(txq);
- 
- 	ff_flushdone:
- 		ATH_HARDSTART_GET_TX_BUF_WITH_LOCK;
--		if (bf == NULL)
--			goto hardstart_fail;
-+		ATH_HARDSTART_REL_TX_BUF_WITH_TXQLOCK_OFF;
- 	}
- 
- ff_bypass:
-@@ -5668,6 +5668,7 @@
- 				sc->sc_stats.ast_rx_phyerr++;
- 				phyerr = ds->ds_rxstat.rs_phyerr & 0x1f;
- 				sc->sc_stats.ast_rx_phy[phyerr]++;
-+				goto rx_next;
- 			}
- 			if (ds->ds_rxstat.rs_status & HAL_RXERR_DECRYPT) {
- 				/*
-@@ -7662,6 +7663,7 @@
- ath_draintxq(struct ath_softc *sc)
- {
- 	struct ath_hal *ah = sc->sc_ah;
-+	int npend = 0;
- 	unsigned int i;
- 
- 	/* XXX return value */
 @@ -7670,9 +7672,24 @@
  		DPRINTF(sc, ATH_DEBUG_RESET, "%s: beacon queue 0x%x\n",
  			__func__, ath_hal_gettxbuf(ah, sc->sc_bhalq));
diff --git a/package/madwifi/patches/300-napi_polling.patch b/package/madwifi/patches/300-napi_polling.patch
index d5c2dfc543..6572112b67 100644
--- a/package/madwifi/patches/300-napi_polling.patch
+++ b/package/madwifi/patches/300-napi_polling.patch
@@ -161,6 +161,14 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
  		sc->sc_stats.ast_tx_nobuf++;				\
  		goto hardstart_fail;					\
  	}
+@@ -2490,6 +2490,7 @@
+ 		DPRINTF(sc,ATH_DEBUG_XMIT,				\
+ 			"%s: discard, no xmit buf\n", __func__);	\
+ 		sc->sc_stats.ast_tx_nobuf++;				\
++		goto hardstart_fail;					\
+ 	}
+ 
+ /*
 @@ -2552,6 +2584,7 @@
  	if (M_FLAG_GET(skb, M_UAPSD)) {
  		/* bypass FF handling */
@@ -225,6 +233,24 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
  			goto ff_flushdone;
  		}
  		/*
+@@ -2676,14 +2677,13 @@
+ 		else if (an->an_tx_ffbuf[skb->priority]) {
+ 			DPRINTF(sc, ATH_DEBUG_XMIT | ATH_DEBUG_FF,
+ 				"%s: Out-Of-Order fast-frame\n", __func__);
+-			ATH_TXQ_UNLOCK(txq);
++			ATH_TXQ_UNLOCK_BH(txq);
+ 		} else
+-			ATH_TXQ_UNLOCK(txq);
++			ATH_TXQ_UNLOCK_BH(txq);
+ 
+ 	ff_flushdone:
+ 		ATH_HARDSTART_GET_TX_BUF_WITH_LOCK;
+-		if (bf == NULL)
+-			goto hardstart_fail;
++		ATH_HARDSTART_REL_TX_BUF_WITH_TXQLOCK_OFF;
+ 	}
+ 
+ ff_bypass:
 @@ -2691,6 +2725,7 @@
  #else /* ATH_SUPERG_FF */
  
@@ -384,6 +410,14 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
  		skb = bf->bf_skb;
  		if (skb == NULL) {		/* XXX ??? can this happen */
  			printk("%s: no skbuff (%s)\n", dev->name, __func__);
+@@ -5668,6 +5668,7 @@
+ 				sc->sc_stats.ast_rx_phyerr++;
+ 				phyerr = ds->ds_rxstat.rs_phyerr & 0x1f;
+ 				sc->sc_stats.ast_rx_phy[phyerr]++;
++				goto rx_next;
+ 			}
+ 			if (ds->ds_rxstat.rs_status & HAL_RXERR_DECRYPT) {
+ 				/*
 @@ -5878,6 +5923,25 @@
  		STAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
  		ATH_RXBUF_UNLOCK_IRQ(sc);
@@ -540,6 +574,14 @@ diff -urN madwifi-ng-refcount-r2313-20070505.old/ath/if_ath.c madwifi-ng-refcoun
  	netif_wake_queue(dev);
  
  	if (sc->sc_softled)
+@@ -7662,6 +7663,7 @@
+ ath_draintxq(struct ath_softc *sc)
+ {
+ 	struct ath_hal *ah = sc->sc_ah;
++	int npend = 0;
+ 	unsigned int i;
+ 
+ 	/* XXX return value */
 @@ -9221,9 +9316,9 @@
  	dev->mtu = mtu;
  	if ((dev->flags & IFF_RUNNING) && !sc->sc_invalid) {