--- a/sys/netproto/802_11/wlan/ieee80211_ageq.c	2026-09-13 09:25:32.937392907 +0000
+++ b/sys/netproto/802_11/wlan/ieee80211_ageq.c	2026-09-13 09:25:32.949392754 +0000
@@ -112,6 +112,16 @@
 		} else {
 			aq->aq_tail->m_nextpkt = m;
 			age -= M_AGE_GET(aq->aq_head);
+			/*
+			 * Caller-supplied ages are not monotonic: the DWDS
+			 * staging age derives from the station's association
+			 * listen-interval, which is attacker-controlled and
+			 * unvalidated.  Clamp so we never store a negative
+			 * relative age (KASSERT panic on INVARIANTS kernels,
+			 * silently bogus expiry otherwise).
+			 */
+			if (age < 0)
+				age = 0;
 		}
 		KASSERT(age >= 0, ("age %d", age));
 		M_AGE_SET(m, age);