The Tx descriptors have 20 "scatter-gather" slots, but two of those are used to transfer the command, so only 18 remain for the actual packet data. So limit the number of dma segments to IWM_NUM_OF_TBS - 2. We use the same approach in iwn(4), except that there only one slot is used for the command, so it uses IWN_MAX_SCATTER - 1.
I suspect that this bug is responsible for the iwm0: hardware error, stopping device errors I sometimes see when we listing long directories when ssh'ed in over iwm(4). We all know ssh loves creating long fragmented mbuf lists. ok? Index: if_iwm.c =================================================================== RCS file: /cvs/src/sys/dev/pci/if_iwm.c,v retrieving revision 1.40 diff -u -p -r1.40 if_iwm.c --- if_iwm.c 21 May 2015 22:13:55 -0000 1.40 +++ if_iwm.c 21 May 2015 22:31:46 -0000 @@ -1113,7 +1113,8 @@ iwm_alloc_tx_ring(struct iwm_softc *sc, paddr += sizeof(struct iwm_device_cmd); error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, - IWM_NUM_OF_TBS, MCLBYTES, 0, BUS_DMA_NOWAIT, &data->map); + IWM_NUM_OF_TBS - 2, MCLBYTES, 0, BUS_DMA_NOWAIT, + &data->map); if (error != 0) { printf("%s: could not create TX buf DMA map\n", DEVNAME(sc)); goto fail;