--- a/sys/netproto/802_11/wlan/ieee80211_wds.c
+++ b/sys/netproto/802_11/wlan/ieee80211_wds.c
@@ -170,6 +170,13 @@ ieee80211_create_wds(struct ieee80211vap *vap, struct ieee80211_channel *chan)
 			IEEE80211_DPRINTF(vap, IEEE80211_MSG_WDS,
 			    "%s: station %s in use with %s\n",
 			    __func__, ether_sprintf(vap->iv_des_bssid),
 			    ni->ni_wdsvap->iv_ifp->if_xname);
 			/* XXX stat? */
+			/*
+			 * DF-3430: drop the reference acquired by
+			 * ieee80211_find_node_locked() - this branch does
+			 * not consume it (the success branch below
+			 * transfers it to iv_bss).
+			 */
+			ieee80211_free_node(ni);
 		} else {
 			/*
 			 * Committed to new node, setup state.