kernel - Fix double-free in if_ath, fix lost rcvif.

kernel - Fix double-free in if_ath, fix lost rcvif.

* Reassign rcvif in ieee80211_vap_pkt_send_dest() prior to calling
  ic_transmit().  The rcvif assignment can get lost from packet
  manipulation above that section of code.

* Fix a double-free in if_ath in the error path for ath_transmit().
  Callers of ic_transmit (aka ath_transmit in this case) expect the
  mbuf to remain intact on a non-zero error return.

* Document confusing code in WPI.

Reported-by: marino
Reviewed-by: sephe