diff -u -r a/sys/dev/netif/ral/rt2860.c b/sys/dev/netif/ral/rt2860.c
--- a/sys/dev/netif/ral/rt2860.c	2026-09-16 01:09:21.429760599 +0000
+++ b/sys/dev/netif/ral/rt2860.c	2026-09-16 01:09:33.269611192 +0000
@@ -1137,7 +1137,8 @@
 		ni = sc->wcid2ni[wcid];
 
 		/* if no ACK was requested, no feedback is available */
-		if (!(stat & RT2860_TXQ_ACKREQ) || wcid == 0xff || ni == NULL)
+		if (!(stat & RT2860_TXQ_ACKREQ) ||
+		    wcid == 0xff || wcid >= RT2860_WCID_MAX || ni == NULL)
 			continue;
 
 		/* update per-STA AMRR stats */
diff -u -r a/sys/dev/netif/ral/rt2860var.h b/sys/dev/netif/ral/rt2860var.h
--- a/sys/dev/netif/ral/rt2860var.h	2026-09-16 01:09:21.429760599 +0000
+++ b/sys/dev/netif/ral/rt2860var.h	2026-09-16 01:09:28.557670653 +0000
@@ -26,6 +26,13 @@
 
 /* HW supports up to 255 STAs */
 #define RT2860_WCID_MAX		254
+/*
+ * The WCID fields latched into TXWI / TX_STAT_FIFO are 8-bit, while
+ * ni_associd is 14-bit (STA mode: taken verbatim from the AP's assoc
+ * response).  The map must therefore cover the whole truncatable space,
+ * otherwise AID 254/255 index past the array into txq[0] (DF-3748).
+ */
+#define RT2860_WCID_MAPSZ	256
 #define RT2860_AID2WCID(aid)	((aid) & 0xff)
 
 struct rt2860_rx_radiotap_header {
@@ -145,7 +152,7 @@
 #define RT2860_PCIE		(1 << 2)
 #define	RT2860_RUNNING		(1 << 3)
 
-	struct ieee80211_node		*wcid2ni[RT2860_WCID_MAX];
+	struct ieee80211_node		*wcid2ni[RT2860_WCID_MAPSZ];
 
 	struct rt2860_tx_ring		txq[6];
 	struct rt2860_rx_ring		rxq;