diff --git a/sys/dev/netif/ath/ath_hal/ar5416/ar5416_xmit.c b/sys/dev/netif/ath/ath_hal/ar5416/ar5416_xmit.c
--- a/sys/dev/netif/ath/ath_hal/ar5416/ar5416_xmit.c
+++ b/sys/dev/netif/ath/ath_hal/ar5416/ar5416_xmit.c
@@ -580,13 +580,12 @@
 
 	ads->ds_ctl2 = 0;
 	ads->ds_ctl3 = 0;
-	if (keyIx != HAL_TXKEYIX_INVALID) {
+	if (keyIx != HAL_TXKEYIX_INVALID && keyIx < AR5416_KEYTABLE_SIZE) {
 		/* XXX validate key index */
 		ads->ds_ctl1 |= SM(keyIx, AR_DestIdx);
 		ads->ds_ctl0 |= AR_DestIdxValid;
-	}
-
-	ads->ds_ctl6 |= SM(ahp->ah_keytype[keyIx], AR_EncrType);
+		ads->ds_ctl6 |= SM(ahp->ah_keytype[keyIx], AR_EncrType);
+	}
 	if (isaggr) {
 		ads->ds_ctl6 |= SM(delims, AR_PadDelim);
 	}