kern/59678: "ring->queued > 0" panic from utwn

[abs%absd.org@localhost]

>Number:         59678
>Category:       kern
>Synopsis:       "ring->queued > 0" panic from utwn
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Sep 30 11:55:00 +0000 2025
>Originator:     David Brownlee
>Release:        11.0_BETA
>Organization:
>Environment:
NetBSD forsaken.absd.org 11.0_BETA NetBSD 11.0_BETA (GENERIC) #0: Wed Sep 24 12:39:13 UTC 2025  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/amd64/compile/GENERIC amd64

>Description:
Since running netbsd-11 (beta) on a ThinkPad T14 have had three panics, two from netbsd-11 and one from an (earlier) -current kernel from a

urtwn0 at uhub1 port 4
urtwn0: Realtek (0x0b05) 802.11n NIC (0x18f0), rev 2.00/0.00, addr 12
urtwn0: MAC/BB RTL8188EU, RF 6052 1T1R, address 58:11:22:53:0c:44
urtwn0: 1 rx pipe, 2 tx pipes

kernel diagnostic assertion "ring->queued > 0" failed: file "/usr/src/sys/dev/usb/if_urtwn.c"

I've been tracking the releng builds and have crashdumps and kernels to match

NetBSD 11.0_BETA (GENERIC) #0: Wed Sep 24 12:39:13 UTC 2025
panic: kernel diagnostic assertion "ring->queued > 0" failed: file "/usr/src/sys/dev/usb/if_urtwn.c", line 927 urtwn0: cur=5 next=4 queued=0

NetBSD 11.0_BETA (GENERIC) #0: Fri Aug  8 16:37:51 UTC 2025
panic: kernel diagnostic assertion "ring->queued > 0" failed: file "/usr/src/sys/dev/usb/if_urtwn.c", line 926 urtwn0: cur=9 next=8 queued=0

NetBSD 10.99.14 (GENERIC) #0: Thu Jun 12 10:23:43 UTC 2025
panic: kernel diagnostic assertion "ring->queued > 0" failed: file "/usr/src/sys/dev/usb/if_urtwn.c", line 926 urtwn0: cur=19 next=18 queued=0

>How-To-Repeat:
Run with a RTL8188EU
>Fix: