--- a/sys/netproto/802_11/wlan/ieee80211_hwmp.c	2026-09-10 22:03:27.975193164 +0000
+++ b/sys/netproto/802_11/wlan/ieee80211_hwmp.c	2026-09-10 22:03:27.987193008 +0000
@@ -626,6 +626,16 @@
 	else
 		ni = ieee80211_mesh_find_txnode(vap, da);
 
+	if (ni == NULL) {
+		/* DF-3327: callers can hand us the nexthop of a route that
+		 * exists while still INVALID (fresh M_ZERO route => nexthop
+		 * 00:00:00:00:00:00).  Drop the frame instead of hitting
+		 * KASSERT/NULL-deref below. */
+		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_OUTPUT,
+		    da, NULL, "%s", "no node for HWMP action frame");
+		return ENOENT;
+	}
+
 	if (vap->iv_state == IEEE80211_S_CAC) {
 		IEEE80211_NOTE(vap, IEEE80211_MSG_OUTPUT, ni,
 		    "block %s frame in CAC state", "HWMP action");