--- a/sys/dev/netif/ath/ath/if_ath_tdma.c
+++ b/sys/dev/netif/ath/ath/if_ath_tdma.c
@@ -404,6 +404,16 @@ ath_tdma_update(struct ieee80211_node *ni,
 	 * the packet just received.
 	 */
 	rix = rt->rateCodeToIndex[rs->rs_rate];
+	if (rix == 0xff) {
+		/*
+		 * DF-4722: rateCodeToIndex[] yields 0xff for any rate
+		 * code not in the current table (mode/turbo transitions).
+		 * ath_hal_pkt_txtime() would index rates->info[255] while
+		 * the table holds 64 entries — OOB read and, for garbage
+		 * small rateKbps, a divide-by-zero in computetxtime.
+		 * Skip the timer update instead.
+		 */
+		DPRINTF(sc, ATH_DEBUG_TDMA,
+		    "%s: rate code 0x%x not in current table; skip\n",
+		    __func__, rs->rs_rate);
+		return;
+	}
 
 	/*
 	 * To calculate the packet duration for legacy rates, we