diff --git a/sys/netproto/802_11/wlan/ieee80211_rssadapt.c b/sys/netproto/802_11/wlan/ieee80211_rssadapt.c
--- a/sys/netproto/802_11/wlan/ieee80211_rssadapt.c
+++ b/sys/netproto/802_11/wlan/ieee80211_rssadapt.c
@@ -324,7 +324,19 @@
     const struct ieee80211_node *ni, int success, void *arg1, void *arg2)
 {
 	struct ieee80211_rssadapt_node *ra = ni->ni_rctls;
-	int pktlen = *(int *)arg1, rssi = *(int *)arg2;
+	int pktlen, rssi;
+
+	/*
+	 * Most in-tree drivers (urtwn, ral, wpi, iwn, iwm, bwn) pass NULL as
+	 * arg2 (the rssi pointer); bwn passes the null pointer constant 0.
+	 * Dereferencing it would page-fault in-kernel, so bail out.  arg1
+	 * (pktlen) is guarded defensively for the same reason.
+	 */
+	if (arg1 == NULL || arg2 == NULL)
+		return;
+
+	pktlen = *(int *)arg1;
+	rssi = *(int *)arg2;
 
 	if (success) {
 		ra->ra_nok++;