--- a/sys/dev/netif/ath/ath/if_ath_rx.c	2026-09-19 09:33:41.612721761 +0000
+++ b/sys/dev/netif/ath/ath/if_ath_rx.c	2026-09-19 09:34:12.704324272 +0000
@@ -574,7 +574,15 @@
 
 	rt = sc->sc_currates;
 	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
+	/*
+	 * rs_rate is a raw hardware-reported rate code; the HAL back-map
+	 * rateCodeToIndex[] is pre-initialised to 0xff for every code not
+	 * in the CURRENT mode's rate table (ah.c).  Never use the 0xff
+	 * sentinel to index sc_hwmap[32].
+	 */
 	rix = rt->rateCodeToIndex[rs->rs_rate];
+	if (rix == 0xff)
+		rix = 0;
 	sc->sc_rx_th.wr_rate = sc->sc_hwmap[rix].ieeerate;
 	sc->sc_rx_th.wr_flags = sc->sc_hwmap[rix].rxflags;
 #ifdef AH_SUPPORT_AR5416
@@ -898,6 +906,8 @@
 	if (IFF_DUMPPKTS(sc, ATH_DEBUG_RECV)) {
 		const HAL_RATE_TABLE *rt = sc->sc_currates;
 		uint8_t rix = rt->rateCodeToIndex[rs->rs_rate];
+		if (rix == 0xff)
+			rix = 0;
 
 		ieee80211_dump_pkt(ic, mtod(m, caddr_t), len,
 		    sc->sc_hwmap[rix].ieeerate, rs->rs_rssi);
@@ -986,8 +996,10 @@
 		 */
 		if (type == IEEE80211_FC0_TYPE_DATA) {
 			const HAL_RATE_TABLE *rt = sc->sc_currates;
-			ath_led_event(sc,
-			    rt->rateCodeToIndex[rs->rs_rate]);
+			uint8_t rix = rt->rateCodeToIndex[rs->rs_rate];
+			if (rix == 0xff)
+				rix = 0;
+			ath_led_event(sc, rix);
 		} else if (ticks - sc->sc_ledevent >= sc->sc_ledidle)
 			ath_led_event(sc, 0);
 		}