Hm, I'm still unable to reproduce, I wonder what triggers this bug...

But, if it's not directly kernel-related, it sound serious - userland bits, like wlancond, shouldn't be able to kaboom device like that. Maybe it's worth reporting to cssu's one-man-bug-hunting-army? (freemangordon)

/Estel