Created attachment 2286 [details]
wifi-mac-queue.cc patch

All other functions, including WifiMacQueue::IsEmpty, call Cleanup () to emulate removal of all timed out packets. GetSize() lacks Cleanup () call.

In rare cases it results in GetSize returning value > 0, for example at line

http://code.nsnam.org/ns-3-dev/file/5de21182cbb5/src/wifi/model/mac-low.cc#l1641

Then WifiMacQueue::Dequeue is called, which calls Cleanup (), and returns NULL because all packets have timed out:

http://code.nsnam.org/ns-3-dev/file/5de21182cbb5/src/wifi/model/mac-low.cc#l1665

I don't have testcase yet, but it is fairly obvious that GetSize should not count timed out packets. Patch is attached.

The script in which I get this error is still too large to be used as a testcase. If I manage to reduce it to something simple, I will probably post it as another bug, because in my case packets stored in m_aggregateQueue sometimes timeout during RTS-CTS exchange. What should happen if during RTS-CTS all packets in m_aggregate timeout and there is no A-MPDU to send by the time CTS is received? Probably simple vector should be used for m_aggregateQueue so packets prepared for A-MPDU should never timeout or something like this.