--- a/sys/dev/netif/ath/ath/if_ath.c	2026-09-15 09:49:36.296397602 +0000
+++ b/sys/dev/netif/ath/ath/if_ath.c	2026-09-15 09:49:36.308397452 +0000
@@ -4195,6 +4195,21 @@
 
 	if (ts->ts_status == 0) {
 		u_int8_t txant = ts->ts_antenna;
+
+		/*
+		 * Validate ts->ts_antenna.  The RX path clamps
+		 * rs->rs_antenna for exactly this reason (if_ath_rx.c):
+		 * users with AR9285 NICs reported crashes because the
+		 * hardware-supplied antenna field was "bogusly large".
+		 * ts_antenna is the same class of hardware-fed byte
+		 * (ah_desc.h: "may not be valid for all h/w"); clamp it
+		 * before using it to index the 8-entry antenna counters.
+		 */
+		if (txant > 7) {
+			device_printf(sc->sc_dev,
+			    "%s: ts_antenna > 7 (%d)\n", __func__, txant);
+			txant = 0;
+		}
 		sc->sc_stats.ast_ant_tx[txant]++;
 		sc->sc_ant_tx[txant]++;
 		if (ts->ts_finaltsi != 0)