diff --git a/src/prism2/driver/hfa384x_usb.c b/src/prism2/driver/hfa384x_usb.c
index 5f13849..5ac27f4 100644
--- a/src/prism2/driver/hfa384x_usb.c
+++ b/src/prism2/driver/hfa384x_usb.c
@@ -3832,9 +3832,12 @@ void hfa384x_usbin_ctlx(wlandevice_t *wlandev, struct urb *urb)
 	hfa384x_usbctlx_t	*ctlx;
 
 	DBFENTER;
+
+	ctlx = hw->ctlxq.head;
+
 	/* If the queue is empty or type doesn't match head ctlx */
-	if ( hw->ctlxq.head == NULL || 
-	     hw->ctlxq.head->outbuf.type != (usbin->type&~host2hfa384x_16(0x8000)) ) {
+	if ( ctlx == NULL || 
+	     ctlx->outbuf.type != (usbin->type&~host2hfa384x_16(0x8000)) ) {
 		/* else, type doesn't match */
 		/* ignore it */
 		WLAN_LOG_WARNING0(
@@ -3845,11 +3848,11 @@ void hfa384x_usbin_ctlx(wlandevice_t *wlandev, struct urb *urb)
 
 	WLAN_LOG_DEBUG0(4,"Matched usbin w/ ctlxq->head\n");
 
-	ctlx = hw->ctlxq.head;
+
 	switch ( ctlx->state ) {
 	case HFA384x_USBCTLX_REQ_SUBMITTED:
 		/* Stop the intimer */
-		del_timer(&hw->ctlxq.head->resptimer);
+		del_timer(&ctlx->resptimer);
 
 		/* Set the state to CTLX_RESP_RECEIVED */
 		ctlx->state = HFA384x_USBCTLX_RESP_RECEIVED;
@@ -3863,7 +3866,7 @@ void hfa384x_usbin_ctlx(wlandevice_t *wlandev, struct urb *urb)
 
 	case HFA384x_USBCTLX_REQ_COMPLETE:
 		/* Stop the intimer */
-		del_timer(&hw->ctlxq.head->resptimer);
+		del_timer(&ctlx->resptimer);
 
 		/* Set the state to CTLX_COMPLETE */
 		ctlx->state = HFA384x_USBCTLX_COMPLETE;
@@ -4145,6 +4148,8 @@ void hfa384x_usbout_callback(struct urb *urb)
 	void dbprint_urb(struct urb* urb);
 #endif
 
+	ctlx = hw->ctlxq.head;
+
 	/* Handle a successful usbout packet */
 	switch (hfa384x2host_16(usbout->type)) {
 	case HFA384x_USB_TXFRM:
@@ -4157,8 +4162,8 @@ void hfa384x_usbout_callback(struct urb *urb)
 	case HFA384x_USB_WMEMREQ:
 	case HFA384x_USB_RMEMREQ:
 	/* Validate that request matches head CTLX */
-	if ( hw->ctlxq.head == NULL || 
-	     hw->ctlxq.head->outbuf.type != (usbout->type) ) {
+	if ( ctlx == NULL || 
+	     ctlx->outbuf.type != (usbout->type) ) {
 		/* else, type doesn't match */
 		/* ignore it */
 		WLAN_LOG_WARNING0(
@@ -4169,15 +4174,13 @@ void hfa384x_usbout_callback(struct urb *urb)
 
 	WLAN_LOG_DEBUG0(4,"Matched usbout w/ ctlxq->head\n");
 	
-	ctlx = hw->ctlxq.head;
-
 	if ( urb->status == 0 ) {
 		/* Request portion of a CTLX is successful */
 		switch ( ctlx->state ) {
 		case HFA384x_USBCTLX_REQ_SUBMITTED:
 			/* Success and correct state */
 			/* Stop the reqtimer and set the new state */
-			del_timer(&hw->ctlxq.head->reqtimer);
+			del_timer(&ctlx->reqtimer);
 			ctlx->state = HFA384x_USBCTLX_REQ_COMPLETE;
 			/* Allow machine to continue */
 			break;
@@ -4185,7 +4188,7 @@ void hfa384x_usbout_callback(struct urb *urb)
 		case HFA384x_USBCTLX_RESP_RECEIVED:
 			/* Success and correct state */
 			/* stop the reqtimer and set the new state */
-			del_timer(&hw->ctlxq.head->reqtimer);
+			del_timer(&ctlx->reqtimer);
 			ctlx->state = HFA384x_USBCTLX_COMPLETE;
 
 			/* Call the completion handler */
@@ -4221,8 +4224,8 @@ void hfa384x_usbout_callback(struct urb *urb)
 		case HFA384x_USBCTLX_REQ_SUBMITTED:
 			/* Fail and correct state */
 			/* Stop the reqtimer and resptimer */
-			del_timer(&hw->ctlxq.head->reqtimer);
-			del_timer(&hw->ctlxq.head->resptimer);
+			del_timer(&ctlx->reqtimer);
+			del_timer(&ctlx->resptimer);
 
 			/* Set state to REQ_FAILED */
 			ctlx->state = HFA384x_USBCTLX_REQ_FAILED;