madwifi: fix a crash bug related to refcounting of bss nodes