--- a/sys/dev/netif/iwn/if_iwn.c
+++ b/sys/dev/netif/iwn/if_iwn.c
@@ -3897,7 +3897,12 @@ iwn_notif_intr(struct iwn_softc *sc)
 	bus_dmamap_sync(sc->rxq.stat_dma.tag, sc->rxq.stat_dma.map,
 	    BUS_DMASYNC_POSTREAD);
 
-	hw = le16toh(sc->rxq.stat->closed_count) & 0xfff;
+	/*
+	 * The RX ring has IWN_RX_RING_COUNT descriptors; a firmware value
+	 * outside that range could never match rxq.cur (mod ring size) and
+	 * would wedge the loop below forever.  Mask to the ring size.
+	 */
+	hw = le16toh(sc->rxq.stat->closed_count) & (IWN_RX_RING_COUNT - 1);
 	while (sc->rxq.cur != hw) {