if (priv->cmd_timed_out && priv->cur_cmd) {
                        struct cmd_ctrl_node *cmdnode = priv->cur_cmd;
  
-                       if (++priv->nr_retries > 10) {
-                               lbs_pr_info("Excessive timeouts submitting command %x\n",
-                                           le16_to_cpu(cmdnode->cmdbuf->command));
+                       if (++priv->nr_retries > 3) {
+                               lbs_pr_info("Excessive timeouts submitting "
+                                       "command 0x%04x\n",
+                                       le16_to_cpu(cmdnode->cmdbuf->command));
                                lbs_complete_command(priv, cmdnode, -ETIMEDOUT);
                                priv->nr_retries = 0;
+                               if (priv->reset_card)
+                                       priv->reset_card(priv);
                        } else {
                                priv->cur_cmd = NULL;
-                               lbs_pr_info("requeueing command %x due to timeout (#%d)\n",
-                                           le16_to_cpu(cmdnode->cmdbuf->command), priv->nr_retries);
 +                              priv->dnld_sent = DNLD_RES_RECEIVED;
+                               lbs_pr_info("requeueing command 0x%04x due "
+                                       "to timeout (#%d)\n",
+                                       le16_to_cpu(cmdnode->cmdbuf->command),
+                                       priv->nr_retries);
  
                                /* Stick it back at the _top_ of the pending queue
                                   for immediate resubmission */
        rtap_dev->stop = lbs_rtap_stop;
        rtap_dev->get_stats = lbs_rtap_get_stats;
        rtap_dev->hard_start_xmit = lbs_rtap_hard_start_xmit;
-       rtap_dev->set_multicast_list = lbs_set_multicast_list;
        rtap_dev->priv = priv;
 +      SET_NETDEV_DEV(rtap_dev, priv->dev->dev.parent);
  
        ret = register_netdev(rtap_dev);
        if (ret) {
 
        hdr->flags = cpu_to_le32(flags);
        hdr->len = 0;
        hdr->rts_duration = rts_dur;
-       hdr->retry = cpu_to_le32(control->retry_limit << 8);
+       hdr->retry = cpu_to_le32(info->control.retry_limit << 8);
  
-       info = (struct rtl8187_tx_info *)skb->cb;
-       info->control = kmemdup(control, sizeof(*control), GFP_ATOMIC);
-       info->urb = urb;
-       info->dev = dev;
+       info->driver_data[0] = dev;
+       info->driver_data[1] = urb;
        usb_fill_bulk_urb(urb, priv->udev, usb_sndbulkpipe(priv->udev, 2),
                          hdr, skb->len, rtl8187_tx_cb, skb);
 -      usb_submit_urb(urb, GFP_ATOMIC);
 +      rc = usb_submit_urb(urb, GFP_ATOMIC);
 +      if (rc < 0) {
 +              usb_free_urb(urb);
 +              kfree_skb(skb);
 +      }
  
        return 0;
  }