diff --git a/sys/netproto/802_11/wlan/ieee80211_hwmp.c b/sys/netproto/802_11/wlan/ieee80211_hwmp.c
--- a/sys/netproto/802_11/wlan/ieee80211_hwmp.c
+++ b/sys/netproto/802_11/wlan/ieee80211_hwmp.c
@@ -1968,7 +1968,20 @@
 
 	/* RANN ACCEPTED */
 
-	ieee80211_hwmp_rannint = rann->rann_interval; /* XXX: mtx lock? */
+	/*
+	 * rann_interval comes from an untrusted on-the-wire RANN frame.
+	 * Validate it (reject zero / sub-tick values that would pin the
+	 * root callout at hard-clock frequency) and publish it atomically
+	 * so concurrent sysctl reads and rootmode callouts see a consistent
+	 * value.  The old code did an unlocked plain store with an
+	 * open "XXX: mtx lock?" comment.
+	 */
+	{
+		int newint = rann->rann_interval;
+		if (newint < ieee80211_hwmp_rootint)
+			newint = ieee80211_hwmp_rootint;
+		atomic_swap_int(&ieee80211_hwmp_rannint, newint);
+	}
 	metric = rann->rann_metric + ms->ms_pmetric->mpm_metric(ni);
 
 	if (rt == NULL) {