--- a/sys/dev/netif/ath/ath/if_ath.c	2026-09-15 09:49:36.296397602 +0000
+++ b/sys/dev/netif/ath/ath/if_ath.c	2026-09-15 09:53:00.713838461 +0000
@@ -1811,6 +1811,20 @@
 
 	ath_draintxq(sc, ATH_RESET_DEFAULT);
 
+	/*
+	 * Ensure no deferred ath task (tx completion, txq scheduling,
+	 * rx processing) is still running or queued with references to
+	 * this vap (av_mcastq linkage, bf_comp callbacks) before the
+	 * vap memory is reclaimed below.  ath_reset() and
+	 * ath_key_update_begin() block this same taskqueue for the same
+	 * reason; the original code only disabled interrupts here,
+	 * which does not stop an already-running task.
+	 */
+	taskqueue_block(sc->sc_tq);
+	taskqueue_drain(sc->sc_tq, &sc->sc_txtask);
+	taskqueue_drain(sc->sc_tq, &sc->sc_txqtask);
+	taskqueue_drain(sc->sc_tq, &sc->sc_rxtask);
+
 	ATH_LOCK(sc);
 	/*
 	 * Reclaim beacon state.  Note this must be done before