USB async read question

[Dmitry Cherkassov <4da.darkstar%gmail.com@localhost>]

Hi, just another newbie question.

In my driver for samsung usb wimax driver I register an async read callback:

<code>
usbd_status
wimax_async_read(struct wimax_softc *sc)
{
    usbd_xfer_handle    xfer;
    usbd_status     err;
    int         total_len = 0, s;

    s = splnet();

    xfer = usbd_alloc_xfer(sc->wimax_udev);

    usbd_setup_xfer(xfer, sc->rx_pipe, 0, sc->recv_buff, sc->bulk_in_len,

USBD_SHORT_XFER_OK,  5000, recv_callback);

    err = usbd_transfer(xfer);

    splx(s);
}
</code>

The callback function itself:

<code>
void recv_callback(usbd_xfer_handle xh, usbd_private_handle priv,
usbd_status stat)
{
    char *buf;
    char count;
    printf("in callback!\n");
    usbd_get_xfer_status(xh, 0, 0, &count, 0);
    printf("data transferred: %d\nstatus = %s", count, usbd_errstr(stat));
}
</code>

Than I send requests to my device using that:

<code>
usbd_status
wimax_usb_write(struct wimax_softc *sc, u_int16_t length, u_int8_t *data)
{
    usbd_xfer_handle    xfer;
    usbd_status     err;
    int         total_len = 0, s;

    s = splnet();

    xfer = usbd_alloc_xfer(sc->wimax_udev);

    usbd_setup_xfer(xfer, sc->tx_pipe, 0, data, length,

USBD_SHORT_XFER_OK,  1000, NULL);

    err = usbd_sync_transfer(xfer);

    usbd_get_xfer_status(xfer, NULL, NULL, &total_len, NULL);

    printf("%s: transfered 0x%x bytes out\n",
                USBDEVNAME(sc->wimax_dev), total_len);

    usbd_free_xfer(xfer);

    splx(s);
    return(err);
}
</code>

The problem is:

When my callback gets called the status it gets as argument is IOERROR.

Also when

usbd_get_xfer_status(xh, 0, 0, &count, 0)
in callback function is called.
I get:
trap type 6 code eip ***** cs * eflags **** cr2 * ilevel *

and my machine reboots in a split-second.

Could someone point what am I doing wrong?

Thank you!