diff --git a/sys/netproto/802_11/wlan/ieee80211_ioctl.c b/sys/netproto/802_11/wlan/ieee80211_ioctl.c
--- a/sys/netproto/802_11/wlan/ieee80211_ioctl.c
+++ b/sys/netproto/802_11/wlan/ieee80211_ioctl.c
@@ -2277,8 +2277,13 @@
 
 	if (ireq->i_len == 0) {		/* delete any existing ie */
 		if (app != NULL) {
-			*aie = NULL;	/* XXX racey */
-			IEEE80211_FREE(app, M_80211_NODE_IE);
+			/*
+			 * XXX the TX paths read iv_appie_* without a ref.
+			 * The full fix is to refcount the appie; until then we
+			 * cannot safely free here, so leak the old appie to avoid
+			 * a use-after-free in the beacon/probe TX path.
+			 */
+			*aie = NULL;
 		}
 		return 0;
 	}