diff --git a/iwlwifi-bz785561.patch b/iwlwifi-bz785561.patch
new file mode 100644
index 0000000..1c9a9d5
--- /dev/null
+++ b/iwlwifi-bz785561.patch
@@ -0,0 +1,50 @@
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
+index d9d758e..1b70048 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
+@@ -95,6 +95,7 @@ static void iwlagn_tx_cmd_build_basic(struct iwl_priv *priv,
+ 			tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
+ 		else
+ 			tx_flags &= ~TX_CMD_FLG_SEQ_CTL_MSK;
++		tx_cmd->tid_tspec = IWL_MAX_TID_COUNT;
+ 	}
+ 
+ 	iwlagn_tx_cmd_protection(priv, info, fc, &tx_flags);
+@@ -808,6 +809,8 @@ static void iwl_rx_reply_tx_agg(struct iwl_priv *priv,
+ 	u32 status = le16_to_cpu(tx_resp->status.status);
+ 	int i;
+ 
++	WARN_ON(tid == IWL_MAX_TID_COUNT);
++
+ 	if (agg->wait_for_ba)
+ 		IWL_DEBUG_TX_REPLY(priv,
+ 			"got tx response w/o block-ack\n");
+@@ -1035,10 +1038,12 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb,
+ 		}
+ 
+ 		__skb_queue_head_init(&skbs);
+-		priv->tid_data[sta_id][tid].next_reclaimed = next_reclaimed;
+ 
+-		IWL_DEBUG_TX_REPLY(priv, "Next reclaimed packet:%d",
+-					  next_reclaimed);
++		if (tid != IWL_MAX_TID_COUNT) {
++			priv->tid_data[sta_id][tid].next_reclaimed = next_reclaimed;
++			IWL_DEBUG_TX_REPLY(priv, "Next reclaimed packet:%d",
++						  next_reclaimed);
++		}
+ 
+ 		/*we can free until ssn % q.n_bd not inclusive */
+ 		WARN_ON(iwl_trans_reclaim(trans(priv), sta_id, tid, txq_id,
+diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
+index aa87994..fa1b369 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
++++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
+@@ -1551,7 +1551,7 @@ static int iwl_trans_pcie_reclaim(struct iwl_trans *trans, int sta_id, int tid,
+ 
+ 	txq->time_stamp = jiffies;
+ 
+-	if (unlikely(txq_id >= IWLAGN_FIRST_AMPDU_QUEUE &&
++	if (unlikely(tid != IWL_MAX_TID_COUNT && txq_id >= IWLAGN_FIRST_AMPDU_QUEUE &&
+ 		     txq_id != trans_pcie->agg_txq[sta_id][tid])) {
+ 		/*
+ 		 * FIXME: this is a uCode bug which need to be addressed,
diff --git a/kernel.spec b/kernel.spec
index 1e10d27..395bec4 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -828,6 +828,7 @@ Patch50107: mac80211-set-bss_conf.idle-when-vif-is-connected.patch
 Patch50108: iwlwifi-fix-PCI-E-transport-inta-race.patch
 
 Patch50200: ath9k-use-WARN_ON_ONCE-in-ath_rc_get_highest_rix.patch
+Patch50201: iwlwifi-bz785561.patch
 
 %endif
 
@@ -1597,6 +1598,8 @@ ApplyPatch iwlwifi-fix-PCI-E-transport-inta-race.patch
 
 ApplyPatch ath9k-use-WARN_ON_ONCE-in-ath_rc_get_highest_rix.patch
 
+ApplyPatch iwlwifi-bz785561.patch
+
 cd ..
 
 %endif
@@ -2302,6 +2305,9 @@ fi
 # and build.
 
 %changelog
+* Tue Jan 31 2012 John W. Linville <linville@redhat.com>
+- Apply iwlwifi patch for TID issue (rhbz 785561)
+
 * Mon Jan 30 2012 Dave Jones <davej@redhat.com>
 - Enable kmemleak (off by default) in kernel-debug (rhbz 782419)