diff --git a/sys/netproto/802_11/wlan/ieee80211_ht.c b/sys/netproto/802_11/wlan/ieee80211_ht.c
--- a/sys/netproto/802_11/wlan/ieee80211_ht.c
+++ b/sys/netproto/802_11/wlan/ieee80211_ht.c
@@ -616,6 +616,15 @@
 static __inline void
 ampdu_dispatch(struct ieee80211_node *ni, struct mbuf *m)
 {
+	/*
+	 * XXX Re-entry hazard: this calls ieee80211_input() which may recurse
+	 * into BAR/action/crypto paths that touch the same rx ampdu state (rap)
+	 * while the caller iterates rxa_m[]. The M_AMPDU_MPDU bypass only prevents
+	 * re-entry into the reorder path, not these other paths; the existing
+	 * KASSERTs in this file exist precisely because this has gone wrong before.
+	 * A full fix must defer/snapshot the iteration so rap cannot be mutated
+	 * underneath the loop.
+	 */
 	m->m_flags |= M_AMPDU_MPDU;	/* bypass normal processing */
 	/* NB: rssi and noise are ignored w/ M_AMPDU_MPDU set */
 	(void) ieee80211_input(ni, m, 0, 0);