diff --git a/sys/dev/netif/ath/ath/if_ath_rx_edma.c b/sys/dev/netif/ath/ath/if_ath_rx_edma.c
--- a/sys/dev/netif/ath/ath/if_ath_rx_edma.c
+++ b/sys/dev/netif/ath/ath/if_ath_rx_edma.c
@@ -552,13 +552,17 @@
 		 */
 		m_adj(bf->bf_m, sc->sc_rx_statuslen);
 
-		/* Handle the frame */
+		/* Handle the frame.  Re-acquire the RX lock around ath_rx_pkt
+		 * because it dereferences re->m_rxpending which stoprecv may
+		 * free concurrently. */
 
 		rs = &bf->bf_status.ds_rxstat;
 		m = bf->bf_m;
 		bf->bf_m = NULL;
+		ATH_RX_LOCK(sc);
 		if (ath_rx_pkt(sc, rs, bf->bf_rxstatus, tsf, nf, qtype, bf, m))
 			ngood++;
+		ATH_RX_UNLOCK(sc);
 	}
 
 	if (ngood) {