When moving from AUTH state to INIT or SCAN state the iwx(4) driver
performs the following two steps:
1. Remove the formerly chosen access point from the firmware's station table
2. Flush firmware Tx queues
This order of operations was inherited from iwm(4) where it works fine.
But iwx(4) firmware has changed how the flushing step works.
Flushing the Tx path now depends on the station being present in the
firmware's station table. So the driver should flush the Tx path before
removing the station. Otherwise, we get a fatal firmware error when the
driver moves out of AUTH state.
I came across this bug while testing unrelated changes. Perhaps it's been
triggered in the wild, perhaps not. There are worse problems in this driver
which I haven't figured out yet. But this one was easy to figure out and fix.