static u16 generate_cookie(struct bcm43xx_dmaring *ring,
                           int slot)
 {
-       u16 cookie = 0x0000;
+       u16 cookie = 0xF000;
 
        /* Use the upper 4 bits of the cookie as
         * DMA controller ID and store the slot number
-        * in the lower 12 bits
+        * in the lower 12 bits.
+        * Note that the cookie must never be 0, as this
+        * is a special value used in RX path.
         */
        switch (ring->mmio_base) {
        default:
                assert(0);
        case BCM43xx_MMIO_DMA1_BASE:
+               cookie = 0xA000;
                break;
        case BCM43xx_MMIO_DMA2_BASE:
-               cookie = 0x1000;
+               cookie = 0xB000;
                break;
        case BCM43xx_MMIO_DMA3_BASE:
-               cookie = 0x2000;
+               cookie = 0xC000;
                break;
        case BCM43xx_MMIO_DMA4_BASE:
-               cookie = 0x3000;
+               cookie = 0xD000;
                break;
        }
        assert(((u16)slot & 0xF000) == 0x0000);
        struct bcm43xx_dmaring *ring = NULL;
 
        switch (cookie & 0xF000) {
-       case 0x0000:
+       case 0xA000:
                ring = dma->tx_ring0;
                break;
-       case 0x1000:
+       case 0xB000:
                ring = dma->tx_ring1;
                break;
-       case 0x2000:
+       case 0xC000:
                ring = dma->tx_ring2;
                break;
-       case 0x3000:
+       case 0xD000:
                ring = dma->tx_ring3;
                break;
        default:
                /* We received an xmit status. */
                struct bcm43xx_hwxmitstatus *hw = (struct bcm43xx_hwxmitstatus *)skb->data;
                struct bcm43xx_xmitstatus stat;
+               int i = 0;
 
                stat.cookie = le16_to_cpu(hw->cookie);
+               while (stat.cookie == 0) {
+                       if (unlikely(++i >= 10000)) {
+                               assert(0);
+                               break;
+                       }
+                       udelay(2);
+                       barrier();
+                       stat.cookie = le16_to_cpu(hw->cookie);
+               }
                stat.flags = hw->flags;
                stat.cnt1 = hw->cnt1;
                stat.cnt2 = hw->cnt2;