Pull up following revision(s) (requested by nat in ticket #1158):

	sys/dev/usb/if_urtwn.c: revision 1.114
	sys/dev/usb/if_urtwn.c: revision 1.115
	sys/dev/usb/if_urtwn.c: revision 1.116
	sys/dev/usb/if_urtwn.c: revision 1.117
	sys/dev/usb/if_urtwn.c: revision 1.113

Set the pipe index on usb xfer creation.

Plug an xfer leak in the tx error path.

Use the right packet spacing for the 8192EU.
From OpenBSD and confrimed by my own analysis.

Safety first!
Ensure that the receive packet processing does not exceed beyond xfer length.

Fix typo.
Found by Harold Gutch (hgutch@).

Author: MartinHusemann

sys/dev/usb/if_urtwn.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: if_urtwn.c,v 1.105.4.3 2025/07/30 10:54:30 martin Exp $	*/
+/*	$NetBSD: if_urtwn.c,v 1.105.4.4 2025/09/23 12:42:24 martin Exp $	*/
 /*	$OpenBSD: if_urtwn.c,v 1.42 2015/02/10 23:25:46 mpi Exp $	*/
 
 /*-
@@ -25,7 +25,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_urtwn.c,v 1.105.4.3 2025/07/30 10:54:30 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_urtwn.c,v 1.105.4.4 2025/09/23 12:42:24 martin Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -753,6 +753,7 @@ urtwn_alloc_rx_list(struct urtwn_softc *sc)
 			data = &sc->rx_data[j][i];
 
 			data->sc = sc;	/* Backpointer for callbacks. */
+			data->pidx = j;
 
 			error = usbd_create_xfer(sc->rx_pipe[j], URTWN_RXBUFSZ,
 			    0, 0, &data->xfer);
@@ -2546,7 +2547,7 @@ urtwn_rxeof(struct usbd_xfer *xfer, void *priv, usbd_status status)
 	size_t pidx = data->pidx;
 	uint32_t rxdw0;
 	uint8_t *buf;
-	int len, totlen, pktlen, infosz, npkts;
+	int len, totlen, pktlen, infosz, npkts, pktspacing;
 
 	URTWNHIST_FUNC(); URTWNHIST_CALLED();
 	DPRINTFN(DBG_RX, "status=%jd", status, 0, 0, 0);
@@ -2583,8 +2584,13 @@ urtwn_rxeof(struct usbd_xfer *xfer, void *priv, usbd_status status)
 	if (npkts != 0)
 		rnd_add_uint32(&sc->rnd_source, npkts);
 
+	if (ISSET(sc->chip, URTWN_CHIP_92EU))
+		pktspacing = 8;
+	else
+		pktspacing = 128;
+
 	/* Process all of them. */
-	while (npkts-- > 0) {
+	while (npkts-- > 0 && len > 0) {
 		if (__predict_false(len < (int)sizeof(*stat))) {
 			DPRINTFN(DBG_RX, "len(%jd) is short than header",
 			    len, 0, 0, 0);
@@ -2612,8 +2618,7 @@ urtwn_rxeof(struct usbd_xfer *xfer, void *priv, usbd_status status)
 		/* Process 802.11 frame. */
 		urtwn_rx_frame(sc, buf, pktlen);
 
-		/* Next chunk is 128-byte aligned. */
-		totlen = roundup2(totlen, 128);
+		totlen = roundup2(totlen, pktspacing);
 		buf += totlen;
 		len -= totlen;
 	}
@@ -2994,6 +2999,7 @@ urtwn_start(struct ifnet *ifp)
 			device_printf(sc->sc_dev,
 			    "unable to transmit packet\n");
 			if_statinc(ifp, if_oerrors);
+			urtwn_put_tx_data(sc, data);
 			continue;
 		}
 		m_freem(m);
@@ -3359,7 +3365,7 @@ urtwn_llt_init(struct urtwn_softc *sc)
 	if (sc->chip & URTWN_CHIP_88E)
 		pktbuf_count = R88E_TXPKTBUF_COUNT;
 	else if (sc->chip & URTWN_CHIP_92EU)
-		pktbuf_count = R88E_TXPKTBUF_COUNT;
+		pktbuf_count = R92E_TXPKTBUF_COUNT;
 	else
 		pktbuf_count = R92C_TXPKTBUF_COUNT;