Fix up error path handling after the recent churn.

• Don't free the mbuf in the tx path - it uses the transmit path now, so the caller frees the mbuf.
• Don't decrement the node ref upon error - that's up to the caller to do as well.

Tested:

• Intel 5300 3x3 wifi, station mode

Noticed by: <s3erios@gmail.com>