diff --git a/c/src/lib/libbsp/m68k/av5282/ChangeLog b/c/src/lib/libbsp/m68k/av5282/ChangeLog
index 560ced24df..7c1e350b75 100644
--- a/c/src/lib/libbsp/m68k/av5282/ChangeLog
+++ b/c/src/lib/libbsp/m68k/av5282/ChangeLog
@@ -1,3 +1,13 @@
+2009-01-21	Frank Ueberschar <frank.ueberschar@dsa-volgmann.de>
+
+	PR 1354/bsps
+	* network/network.c: In some cases it can occur that an empty mbuf is
+	put on the descriptor chain. (We found it especially then when
+	transmitting fragmented IP Packets.) Since the actual buffer
+	descriptor pointer will be incremented after every inserted mbuf
+	(txBd = sc->txBdBase + sc->txBdHead;) even if m->m_len of the current
+	mbuf was zero. This leads to the bug.
+
 2008-03-03	Joel Sherrill <joel.sherrill@OARcorp.com>
 
 	* startup/linkcmds, startup/linkcmdsflash, startup/linkcmdsram: Add
diff --git a/c/src/lib/libbsp/m68k/av5282/network/network.c b/c/src/lib/libbsp/m68k/av5282/network/network.c
index 7575072425..2dcf1d1e04 100644
--- a/c/src/lib/libbsp/m68k/av5282/network/network.c
+++ b/c/src/lib/libbsp/m68k/av5282/network/network.c
@@ -548,10 +548,10 @@ fec_sendpacket(struct ifnet *ifp, struct mbuf *m)
 		* The IP fragmentation routine in ip_output
 		* can produce fragments with zero length.
 		*/
-		txBd = sc->txBdBase + sc->txBdHead;
 		if (m->m_len){
 			char *p = mtod(m, char *);
 			int offset = (int) p & 0x3;
+			txBd = sc->txBdBase + sc->txBdHead;
 			if (offset == 0) {
 				txBd->buffer = p;
 				txBd->length = m->m_len;