Mystery with corrupted packets

[Clint Herron]

Hello!

I'm using a GuruPlug (Marvell SD8688 wireless chipset) running Debian
6.0 (kernel 2.6.39.4).  It is using the Libertas wireless driver.

One issue that I've noticed is that I'm receiving bad (corrupted?)
packets sent via the wireless interface.  I send these same sorts of
packets via the wired Ethernet interface on my board and haven't had a
problem in hundreds of hours of testing.  But I notice a problem with
corrupt TCP packets fairly regularly on the wireless interface.

I've mainly seen this issue when sending a large number of large TCP
packets that require reassembly (possibly during high periods of
wireless interference and conjestion) are received with bad PDU
lengths during reassembly.  For instance, here is a wireless capture:
https://dl.dropboxusercontent.com/u/2737199/harman/guruplug_wifi_bad_pdu.pcap

In this capture, packets 408, 409, 411, 412, 414, 417, and 418 are all
in a sequence of packets coming from my device.  They should all have
the same size.  However, one of these is not like the other.  Packets
408-417 all have the correct PDU length reported (1716 bytes):
https://dl.dropboxusercontent.com/u/2737199/harman/bad_pdu_1.png

However, packet 418 has a PDU of 105150976 bytes -- an incredibly
bogus value that is crashing the receiver.
https://dl.dropboxusercontent.com/u/2737199/harman/bad_pdu_2.png

We also get bogus PDU values in packets #475 (17434112 bytes) and #735
(16909890 bytes) where normal values are in the range of 1700 or so.

I'm not sure if it matters, but these packets are being generated and
sent from an instance of Mono 2.6.7-5.1.

Best I can tell, this is what I know so far:

1) It happens only on the wireless interface
2) Packets are corrupt / invalid at the TCP level
3) Somehow these bogus values make it through the TCP checksum and
onto the wire and into the receiver.

Could the wireless driver be at fault here?  Is there a good reason
why high wireless interference (by other devices on the same channel)
could possibly be a contributor?  Is there a workaround I could do?
I've looked through the mailing list archives but have not seen any
reported bugs like this.  Are there any known issues with this sort of
thing?  Is there something else I should try?

Thank you for any help you can provide!

Respectfully,
clint