Fix a use-after-free bug in the Atheros fast-frames support.

Tested:

• AR5212 AP, AR5413 STA, iperf TCP STA->AP, destroyed and/or shutdown the STA vap during active iperf TCP traffic.

PR: kern/174273
MFC after: 1 week