--- prism2_ap.c.orig	Fri Dec 21 10:55:16 2001
+++ prism2_ap.c	Fri Dec 21 10:57:38 2001
@@ -93,29 +93,30 @@
 			sta->buffer_count--;
 		}
 		sta->tx_buf_head = sta->tx_buf_tail = NULL;
 	}
 	list_del(&sta->list);
+	ap->num_sta--;
 	kfree(sta);
 }
 
 static void ap_handle_timer(unsigned long data)
 {
 	local_info_t *local = (local_info_t *) data;
 	struct ap_data *ap;
-	struct list_head *ptr;
+	struct list_head *ptr, *n;
 	unsigned long flags;
 
 	if (local == NULL || local->ap == NULL)
 		return;
 
 	ap = local->ap;
 
 	spin_lock_irqsave(&ap->sta_table_lock, flags);
 
-	for (ptr = ap->sta_list.next; ptr != NULL && ptr != &ap->sta_list;
-	     ptr = ptr->next) {
+	for (ptr = ap->sta_list.next, n = ptr->next; ptr != &ap->sta_list;
+	     ptr = n, n = ptr->next) {
 		unsigned long last;
 		struct sta_info *sta = (struct sta_info *) ptr;
 		if (atomic_read(&sta->users) != 0) {
 			PDEBUG(DEBUG_AP, "ap_handle_timer: STA " MACSTR
 			       " users=%i\n",