diff --git a/sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c b/sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c
--- a/sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c
+++ b/sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c
@@ -121,6 +121,7 @@
 {
 	struct ccmp_ctx *ctx = k->wk_private;
 
+	bzero(ctx, sizeof(*ctx));
 	IEEE80211_FREE(ctx, M_80211_CRYPTO);
 	KASSERT(nrefs > 0, ("imbalanced attach/detach"));
 	nrefs--;			/* NB: we assume caller locking */