Description
Network driver lance.o unconditionaly oops on rmmod or auto
unloading.

The same was true with RH6.0

Conclusion.
The following patch works for me.

--- drivers/net/lance.c.orig    Mon Aug  9 23:04:39 1999
+++ drivers/net/lance.c Wed Oct 27 22:07:16 1999
@@ -349,11 +349,11 @@
        for (this_dev = 0; this_dev < MAX_CARDS; this_dev++)
{
                struct device *dev = &dev_lance[this_dev];
                if (dev->priv != NULL) {
-                       kfree(dev->priv);
-                       dev->priv = NULL;
                        free_dma(dev->dma);
                        release_region(dev->base_addr,
LANCE_TOTAL_SIZE);
                        unregister_netdev(dev);
+                       kfree(dev->priv);
+                       dev->priv = NULL;
                }
        }
 }