ath9k: fix a stale bf->bf_next pointer, potentially leading to double-free errors...