--- a/sys/dev/netif/ral/rt2661.c	2026-09-17 06:16:59.148778118 +0000
+++ b/sys/dev/netif/ral/rt2661.c	2026-09-17 06:16:59.152778068 +0000
@@ -903,6 +903,10 @@ rt2661_tx_intr(struct rt2661_softc *sc)
 
 		/* retrieve the queue in which this frame was sent */
 		qid = RT2661_TX_QID(val);
+		if (qid > 4) {		/* 0..3 data rings, 4 mgt ring */
+			DPRINTFN(sc, 1, "bogus tx qid %d\n", qid);
+			continue;
+		}
 		txq = (qid <= 3) ? &sc->txq[qid] : &sc->mgtq;
 
 		/* retrieve rate control algorithm context */
@@ -913,8 +917,11 @@ rt2661_tx_intr(struct rt2661_softc *sc)
 		data->ni = NULL;
 
 		/* if no frame has been sent, ignore */
-		if (ni == NULL)
+		if (ni == NULL) {
+			if (m != NULL)
+				m_freem(m);
 			continue;
+		}
 		else
 			vap = ni->ni_vap;
 
@@ -952,7 +959,8 @@ rt2661_tx_intr(struct rt2661_softc *sc)
 
 		DPRINTFN(sc, 15, "tx done q=%d idx=%u\n", qid, txq->stat);
 
-		txq->queued--;
+		if (txq->queued > 0)
+			txq->queued--;
 		if (++txq->stat >= txq->count)	/* faster than % count */
 			txq->stat = 0;