--- a/sys/netproto/802_11/wlan/ieee80211_hwmp.c	2026-09-10 22:03:27.975193164 +0000
+++ b/sys/netproto/802_11/wlan/ieee80211_hwmp.c	2026-09-10 22:15:56.685500347 +0000
@@ -1820,7 +1820,9 @@
 		    "propagate PERR from %6D", wh->i_addr2, ":");
 #endif
 		pperr->perr_ndests = j;
-		pperr->perr_ttl--;
+		/* DF-3328: pperr was allocated w/o M_ZERO and perr_ttl was
+		 * never initialized; inherit it from the received PERR. */
+		pperr->perr_ttl = perr->perr_ttl - 1;
 		hwmp_send_perr(vap, broadcastaddr, pperr);
 	}
 done: