--- a/sys/netproto/802_11/wlan/ieee80211_hwmp.c
+++ b/sys/netproto/802_11/wlan/ieee80211_hwmp.c
@@ -616-624 hwmp_send_action()
 	if (IEEE80211_IS_MULTICAST(da)) {
 		ni = ieee80211_ref_node(vap->iv_bss);
-		...
-		ieee80211_ref_node(ni);	/* <-- remove: second reference */
 	}
 	(keep exactly ONE reference for the mbuf tx path, as upstream does)