diff --git a/sys/bus/u4b/wlan/if_urtwn.c b/sys/bus/u4b/wlan/if_urtwn.c
--- a/sys/bus/u4b/wlan/if_urtwn.c
+++ b/sys/bus/u4b/wlan/if_urtwn.c
@@ -1100,7 +1100,8 @@
 
 		/* Map HW rate index to 802.11 rate. */
 		if (!(rxdw3 & R92C_RXDW3_HT)) {
-			tap->wr_rate = ridx2rate[rate];
+			if (rate < nitems(ridx2rate))
+				tap->wr_rate = ridx2rate[rate];
 		} else if (rate >= 12) {	/* MCS0~15. */
 			/* Bit 7 set means HT MCS instead of rate. */
 			tap->wr_rate = 0x80 | (rate - 12);