diff --git a/sys/bus/u4b/wlan/if_mtw.c b/sys/bus/u4b/wlan/if_mtw.c
--- a/sys/bus/u4b/wlan/if_mtw.c
+++ b/sys/bus/u4b/wlan/if_mtw.c
@@ -545,8 +545,10 @@
 		    usbd_errstr(error));
 		goto detach;
 	}
-	sc->txd_fw = (struct mtw_txd_fw *)kmalloc(MTW_MAX_TXSZ,
-	    M_USBDEV, M_WAITOK | M_ZERO);
+	/* txd_fw must hold a full firmware chunk (mtw_ucode_write copies up to
+	 * 0x2000 bytes into ->buf), which is far larger than MTW_MAX_TXSZ. */
+	sc->txd_fw = (struct mtw_txd_fw *)kmalloc(sizeof(struct mtw_txd_fw) +
+	    0x2000 + MTW_DMA_PAD, M_USBDEV, M_WAITOK | M_ZERO);
 	MTW_LOCK(sc);
 	mbufq_init(&sc->sc_snd, ifqmaxlen);