--- a/sys/netproto/802_11/wlan/ieee80211_hostap.c
+++ b/sys/netproto/802_11/wlan/ieee80211_hostap.c
@@ -578,6 +578,11 @@ ieee80211_hostap_input(...)
 		IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
 		ni->ni_noise = nf;
 		if (IEEE80211_HAS_SEQ(type, subtype)) {
+			/* DF-3325: the pre-dispatch seq/QoS reads touch
+			 * i_seq(22)/i_qos(24); require a full QoS header */
+			if (m->m_pkthdr.len <
+			    (IEEE80211_QOS_HAS_SEQ(wh) ?
+			     sizeof(struct ieee80211_qosframe) :
+			     sizeof(struct ieee80211_frame)))
+				goto out;
 			uint8_t tid = ieee80211_gettid(wh);