--- a/sys/netproto/802_11/wlan_tkip/ieee80211_crypto_tkip.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/netproto/802_11/wlan_tkip/ieee80211_crypto_tkip.c	2026-10-26 03:31:47.247168419 +0000
@@ -133,6 +133,8 @@
 {
 	struct tkip_ctx *ctx = k->wk_private;
 
+	/* clear derived key material (rc4 keys, phase-1 ttak) */
+	memset(ctx, 0, sizeof(*ctx));
 	IEEE80211_FREE(ctx, M_80211_CRYPTO);
 	KASSERT(nrefs > 0, ("imbalanced attach/detach"));
 	nrefs--;			/* NB: we assume caller locking */