diff --git a/sys/dev/netif/ath/ath/if_ath_ioctl.c b/sys/dev/netif/ath/ath/if_ath_ioctl.c
--- a/sys/dev/netif/ath/ath/if_ath_ioctl.c
+++ b/sys/dev/netif/ath/ath/if_ath_ioctl.c
@@ -296,13 +296,25 @@
 		return (error);
 	}
 #ifdef ATH_DIAGAPI
-	case SIOCGATHDIAG:
+	case SIOCGATHDIAG: {
+		int error = caps_priv_check_self(SYSCAP_NONET_WIFI);
+		if (error)
+			return (error);
 		return (ath_ioctl_diag(sc, data));
-	case SIOCGATHPHYERR:
+	}
+	case SIOCGATHPHYERR: {
+		int error = caps_priv_check_self(SYSCAP_NONET_WIFI);
+		if (error)
+			return (error);
 		return (ath_ioctl_phyerr(sc, data));
+	}
 #endif
-	case SIOCGATHSPECTRAL:
+	case SIOCGATHSPECTRAL: {
+		int error = caps_priv_check_self(SYSCAP_NONET_WIFI);
+		if (error)
+			return (error);
 		return (ath_ioctl_spectral(sc, data));
+	}
 	case SIOCGATHNODERATESTATS:
 		return (ath_ioctl_ratestats(sc, data));
 	default: