A race condition appear to exist between request completion when
scsi_done() is called to end the request and set the tag back to -1 (at
blk_queue_end_tag() scsi_end_request), and scsi layer error handling
which aborts the command and reuses it to request sense data. Sending
the request sense is done with tag which was set to -1 and so it is
invalid. Assert command tag passed from scsi layer is valid.