diff --git a/[refs] b/[refs]
index fae646a063a2..35cb7ce0453f 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 86aa7c1efc63e0969dee575ac9e021dbcbaa95c3
+refs/heads/master: 307749406d7daea452d55df76f734b4fffddf599
diff --git a/trunk/drivers/net/wireless/ath/ath6kl/txrx.c b/trunk/drivers/net/wireless/ath/ath6kl/txrx.c
index c4501a9f051c..78b369286579 100644
--- a/trunk/drivers/net/wireless/ath/ath6kl/txrx.c
+++ b/trunk/drivers/net/wireless/ath/ath6kl/txrx.c
@@ -704,6 +704,10 @@ void ath6kl_tx_complete(struct htc_target *target,
 					  list);
 		list_del(&packet->list);
 
+		if (WARN_ON_ONCE(packet->endpoint == ENDPOINT_UNUSED ||
+				 packet->endpoint >= ENDPOINT_MAX))
+			continue;
+
 		ath6kl_cookie = (struct ath6kl_cookie *)packet->pkt_cntxt;
 		if (WARN_ON_ONCE(!ath6kl_cookie))
 			continue;