--- a/sys/dev/netif/iwn/if_iwn.c
+++ b/sys/dev/netif/iwn/if_iwn.c
@@ -3762,6 +3762,11 @@ iwn_ampdu_tx_done(struct iwn_softc *sc, int qid, int idx, int nframes,
 	/* XXX TODO: status is le16 field! Grr */
 
 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
+
+	if (qid < 0 || qid >= sc->ntxqs || sc->qid2tap[qid] == NULL) {
+		/* Stale/unsolicited TX_DONE for an aggregation queue. */
+		return;
+	}
+
 	DPRINTF(sc, IWN_DEBUG_XMIT, "%s: nframes=%d, status=0x%08x\n",
 	    __func__,
 	    nframes,