--- a/sys/dev/netif/ath/ath_hal/ar5416/ar5416_ani.c	2026-09-21 05:06:13.009245287 +0000
+++ b/sys/dev/netif/ath/ath_hal/ar5416/ar5416_ani.c	2026-09-21 05:06:13.033244978 +0000
@@ -213,6 +213,20 @@
 		return AH_TRUE;
 	}
 
+	/*
+	 * The level/threshold commands below dereference aniState and
+	 * params.  ah_curani is NULL from attach until the first
+	 * ar5416AniReset() (the 5416 softc is allocated zeroed and the
+	 * pointer is only published in ar5416AniReset), so a diagnostic
+	 * HAL_DIAG_ANI_CMD issued before any channel is set must not
+	 * reach them.
+	 */
+	if (aniState == AH_NULL) {
+		HALDEBUG(ah, HAL_DEBUG_ANI, "%s: no current ani state\n",
+		    __func__);
+		return AH_FALSE;
+	}
+
 	/* Check whether the particular function is enabled */
 	if (((1 << cmd) & AH5416(ah)->ah_ani_function) == 0) {
 		HALDEBUG(ah, HAL_DEBUG_ANI, "%s: command %d disabled\n",