
Peer is created but not setup in LFR3 roaming case, then peer->rx_tid[tid].array is not initialized with a valid value before using,which cause null point dereference in dp_rx_defrag_cleanup() when cleaning up peer. Change-Id: Ia8fd7773041511f3865d8ba26f4844d9b33bcec0 CRs-Fixed: 2436112