Monitor mode was broken by a recent firmware update. Two tweaks make
it work again:

1) The firmware does not like us sending the power-mode command while
in monitor mode and will panic, so simply don't do that.

2) We no longer add two queues while in monitor mode, just one queue
for frame injection. This queue's index will be 1, not 2. Make the
driver expect the correct index to prevent an error when monitor mode
is entered.
 
 M  sys/dev/pci/if_iwx.c     |  3+  3-
 M  sys/dev/pci/if_iwxreg.h  |  1+  1-

2 files changed, 4 insertions(+), 4 deletions(-)

diff d4481401f1b866cb10e660d22019c8e8184f14a4 56f6c397433cf540eedb761c27d265335f91d9cb
commit - d4481401f1b866cb10e660d22019c8e8184f14a4
commit + 56f6c397433cf540eedb761c27d265335f91d9cb
blob - 3a4810b4859afba5b87b80859cf896adaa9de017
blob + defa9905408d47eab0d7d81f961eab768c975696
--- sys/dev/pci/if_iwx.c
+++ sys/dev/pci/if_iwx.c
@@ -8323,6 +8323,9 @@ iwx_run(struct iwx_softc *sc)
 		return err;
 	}
 #endif
+	if (ic->ic_opmode == IEEE80211_M_MONITOR)
+		return 0;
+
 	err = iwx_power_mac_update_mode(sc, in);
 	if (err) {
 		printf("%s: could not update MAC power (error %d)\n",
@@ -8330,9 +8333,6 @@ iwx_run(struct iwx_softc *sc)
 		return err;
 	}
 
-	if (ic->ic_opmode == IEEE80211_M_MONITOR)
-		return 0;
-
 	/* Start at lowest available bit-rate. Firmware will raise. */
 	in->in_ni.ni_txrate = 0;
 	in->in_ni.ni_txmcs = 0;
blob - 8713b11a6ea8784f2d5fe115d1eea0e6aa691f0b
blob + 2a4a68e3e12106a8e77891e28315c564a9da65b6
--- sys/dev/pci/if_iwxreg.h
+++ sys/dev/pci/if_iwxreg.h
@@ -1760,7 +1760,7 @@ struct iwx_gen3_bc_tbl_entry {
 #define IWX_DQA_CMD_QUEUE		0
 #define IWX_DQA_AUX_QUEUE		1
 
-#define IWX_DQA_INJECT_MONITOR_QUEUE	2 /* used in monitor mode only */
+#define IWX_DQA_INJECT_MONITOR_QUEUE	1 /* used in monitor mode only */
 #define IWX_DQA_MGMT_QUEUE		1 /* default queue other modes */
 
 /* Reserve 8 DQA Tx queues for QoS data frames. */