ath_tx_txqaddbuf assumes that all the linked buffers in the queue passed
to it are part of the same A-MPDU or MPDU. The CAB queue rework violates
this assumption, which can cause the internal queue depth to go
negative.
Fix this by increasing the counter for all slots of [bf, bf->bf_lastbf]
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
        }
 
        if (!internal) {
-               txq->axq_depth++;
-               if (bf_is_ampdu_not_probing(bf))
-                       txq->axq_ampdu_depth++;
+               while (bf) {
+                       txq->axq_depth++;
+                       if (bf_is_ampdu_not_probing(bf))
+                               txq->axq_ampdu_depth++;
+
+                       bf = bf->bf_lastbf->bf_next;
+               }
        }
 }