--- a/sys/netproto/802_11/wlan/ieee80211_hostap.c
+++ b/sys/netproto/802_11/wlan/ieee80211_hostap.c
@@ -2155,6 +2155,10 @@ hostap_recv_assoc(struct ieee80211_node *ni, ...)
 		if (ath != NULL) {
 			setie(ath_ie, ath - sfrm);
+			/* DF-3324: the Atheros IE must carry the fixed
+			 * capability+defkeyix fields before parse_ath reads them */
+			if (ath[1] < sizeof(struct ieee80211_ath_ie) - 2)
+				ath = NULL;
+			else
 			ieee80211_parse_ath(ni, ni->ni_ies.ath_ie);
 			ni->ni_ath_flags = 0;