--- a/sys/dev/netif/iwi/if_iwi.c
+++ b/sys/dev/netif/iwi/if_iwi.c
@@ -1242,6 +1242,7 @@
 	struct mbuf *mnew, *m;
 	struct ieee80211_node *ni;
 	int type, error, framelen;
+	uint8_t rx_rate;
 	int8_t rssi, nf;
 	IWI_LOCK_DECL;
 
@@ -1332,6 +1333,10 @@
 		tap->wr_rate = iwi_cvtrate(frame->rate);
 		tap->wr_antenna = frame->antenna;
 	}
+	/* capture fw rx rate now: ieee80211_input() consumes/frees m,
+	 * after which `frame' (which points into m) is dangling (DF-3840) */
+	rx_rate = frame->rate;
+
 	IWI_UNLOCK(sc);
 
 	ni = ieee80211_find_rxnode(ic, mtod(m, struct ieee80211_frame_min *));
@@ -1350,7 +1355,7 @@
 		 * periodic beacon frames to trigger the poll event.
 		 */
 		if (type == IEEE80211_FC0_TYPE_DATA) {
-			sc->sc_rxrate = frame->rate;
+			sc->sc_rxrate = rx_rate;
 			iwi_led_event(sc, IWI_LED_RX);
 		} else if (ticks - sc->sc_ledevent >= sc->sc_ledidle)
 			iwi_led_event(sc, IWI_LED_POLL);