--- a/sys/dev/netif/ath/ath/if_ath.c	2026-09-15 09:49:36.296397602 +0000
+++ b/sys/dev/netif/ath/ath/if_ath.c	2026-09-15 09:51:35.122910215 +0000
@@ -2185,9 +2185,28 @@
 					struct ieee80211com *ic = &sc->sc_ic;
 					struct ieee80211vap *vap =
 					    TAILQ_FIRST(&ic->ic_vaps);
-					ath_tdma_beacon_send(sc, vap);
-					sc->sc_tdmaswba =
-					    vap->iv_tdma->tdma_bintval;
+
+					/*
+					 * The vap list may be empty or may
+					 * head with a non-TDMA vap (sc_tdma
+					 * outlives the TDMA vap - it is only
+					 * cleared when sc_nvaps drops to 0).
+					 * iv_tdma is NULL for every
+					 * non-TDMA vap.  Guard both before
+					 * dereferencing from hard intr
+					 * context.
+					 */
+					if (vap == NULL ||
+					    vap->iv_tdma == NULL) {
+						DPRINTF(sc,
+						    ATH_DEBUG_ANY,
+						    "%s: SWBA: no TDMA vap\n",
+						    __func__);
+					} else {
+						ath_tdma_beacon_send(sc, vap);
+						sc->sc_tdmaswba =
+						    vap->iv_tdma->tdma_bintval;
+					}
 				} else
 					sc->sc_tdmaswba--;
 			} else