When I changed the code a bit to say in the 905 txstart:

if (!FREE)
	mbfree();

that was exactly what happen, the second caller of mbfree()
(the second path through the 905 driver) got a nil pointer as
the message buffer in the ring, and paniced, a page fault
followed. Not a surprise, though.

The ring descriptors were different, but the message buffer
was the same. Only need to find out who does that...