[efi] Free transmit ring entry before calling netdev_tx_complete()

The snpnet driver uses netdev_tx_defer() and so must ensure that space
in the (single-entry) transmit descriptor ring is freed up before
calling netdev_tx_complete().

Signed-off-by: Michael Brown <mcb30@ipxe.org>

src/drivers/net/efi/snpnet.c

  */
 static void snpnet_poll_tx ( struct net_device *netdev ) {
 	struct snp_nic *snp = netdev->priv;
+	struct io_buffer *iobuf;
 	UINT32 irq;
 	VOID *txbuf;
 	EFI_STATUS efirc;
 	}
 
 	/* Complete transmission */
-	netdev_tx_complete ( netdev, snp->txbuf );
+	iobuf = snp->txbuf;
 	snp->txbuf = NULL;
+	netdev_tx_complete ( netdev, iobuf );
 }
 
 /**