diff --git a/[refs] b/[refs]
index fb5bd9ba4307..8123ea7c6874 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 3fd07a1e5aba89d4be3696c46cb7297f1873195a
+refs/heads/master: ed7fafec5e566a30fb21586c98cbef76c306d209
diff --git a/trunk/drivers/net/wireless/iwlwifi/iwl-4965.c b/trunk/drivers/net/wireless/iwlwifi/iwl-4965.c
index 881bf0472564..741b425b5883 100644
--- a/trunk/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/trunk/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -2236,7 +2236,7 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
 				   tx_resp->failure_frame);
 
 		freed = iwl_tx_queue_reclaim(priv, txq_id, index);
-		if (qc)
+		if (qc && likely(sta_id != IWL_INVALID_STATION))
 			priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
 
 		if (priv->mac80211_registered &&
@@ -2244,7 +2244,7 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
 			ieee80211_wake_queue(priv->hw, txq_id);
 	}
 
-	if (qc)
+	if (qc && likely(sta_id != IWL_INVALID_STATION))
 		iwl_txq_check_empty(priv, sta_id, tid, txq_id);
 
 	if (iwl_check_bits(status, TX_ABORT_REQUIRED_MSK))