diff --git a/sys/netproto/802_11/wlan/ieee80211_scan_sta.c b/sys/netproto/802_11/wlan/ieee80211_scan_sta.c
--- a/sys/netproto/802_11/wlan/ieee80211_scan_sta.c
+++ b/sys/netproto/802_11/wlan/ieee80211_scan_sta.c
@@ -1418,6 +1418,7 @@
 			/* update public state */
 			se->base.se_age = ticks - se->se_lastupdate;
 			IEEE80211_SCAN_TABLE_UNLOCK(st);
+			/* NB: entry unlocked during callback - race with age/flush (DF-0396) */
 			(*f)(arg, &se->base);
 			goto restart;
 		}