diff --git a/sys/netproto/802_11/wlan/ieee80211_tdma.c b/sys/netproto/802_11/wlan/ieee80211_tdma.c
--- a/sys/netproto/802_11/wlan/ieee80211_tdma.c
+++ b/sys/netproto/802_11/wlan/ieee80211_tdma.c
@@ -654,6 +654,10 @@
 		 * Adopt TDMA configuration when joining an
 		 * existing network.
 		 */
+		/* tdma_inuse is 1 byte (8 slots); reject a slot >= 8 so a
+		   crafted beacon IE does not write past the array. */
+		if (tdma->tdma_slot >= NBBY * sizeof(ts->tdma_inuse))
+			return;
 		setbit(ts->tdma_inuse, tdma->tdma_slot);
 		(void) tdma_update(vap, tdma, ni, 1);
 		/*