--- a/sys/netproto/802_11/wlan/ieee80211_output.c
+++ b/sys/netproto/802_11/wlan/ieee80211_output.c
@@ -3602,7 +3602,23 @@
 			bcopy(bo->bo_tim_trailer, bo->bo_tim_trailer+adjust,
 			      bo->bo_tim_trailer_len);
 			bo->bo_tim_trailer += adjust;
-			bo->bo_appie += adjust;
+			if (bo->bo_appie == NULL) {
+				/*
+				 * First app IE added after the beacon was
+				 * constructed: bo_appie was never set (the
+				 * beacon was built with no app IE).  The new
+				 * IE occupies the vacated space at the head
+				 * of the shifted trailer and becomes part
+				 * of the trailer, so later TIM resizes move
+				 * it too.  Without this, bo_appie stays NULL
+				 * and the pointer arithmetic below writes
+				 * the IE to 0x0+aielen.
+				 */
+				bo->bo_appie = bo->bo_tim_trailer - adjust;
+				bo->bo_tim_trailer = bo->bo_appie;
+				bo->bo_tim_trailer_len += aielen;
+			} else
+				bo->bo_appie += adjust;
 			bo->bo_appie_len = aielen;
 
 			len_changed = 1;