Transmit the buffer contents, not the buffer descriptor...

src/drivers/net/pnic.c

 		if ( qlen == 0 )
 			break;
 		pkb = alloc_pkb ( ETH_FRAME_LEN );
-		if ( ! pkb )
+		if ( ! pkb ) {
+			printf ( "could not allocate buffer\n" );
 			break;
+		}
 		if ( pnic_command ( pnic, PNIC_CMD_RECV, NULL, 0,
 				    pkb->data, ETH_FRAME_LEN, &length )
 		     != PNIC_STATUS_OK ) {
 static int pnic_transmit ( struct net_device *netdev, struct pk_buff *pkb ) {
 	struct pnic *pnic = netdev->priv;
 
-	pnic_command ( pnic, PNIC_CMD_XMIT, pkb, pkb_len ( pkb ),
+	pnic_command ( pnic, PNIC_CMD_XMIT, pkb->data, pkb_len ( pkb ),
 		       NULL, 0, NULL );
 	free_pkb ( pkb );
 	return 0;