--- a/sys/bus/u4b/wlan/if_run.c	2026-10-01 18:36:08.405384357 +0000
+++ b/sys/bus/u4b/wlan/if_run.c	2026-10-01 18:36:29.905108452 +0000
@@ -4884,12 +4884,21 @@
 	}
 
 	setbit(bo->bo_flags, item);
+
+	/*
+	 * DF-5246: run_newstate()/run_vap_delete() free beacon_mbuf
+	 * under RUN_LOCK; serialize the check/alloc/use on the same lock.
+	 */
+	RUN_LOCK(sc);
 	if (rvp->beacon_mbuf == NULL) {
 		rvp->beacon_mbuf = ieee80211_beacon_alloc(ni);
-		if (rvp->beacon_mbuf == NULL)
+		if (rvp->beacon_mbuf == NULL) {
+			RUN_UNLOCK(sc);
 			return;
+		}
 	}
 	ieee80211_beacon_update(ni, rvp->beacon_mbuf, mcast);
+	RUN_UNLOCK(sc);
 
 	i = RUN_CMDQ_GET(&sc->cmdq_store);
 	DPRINTF("cmdq_store=%d\n", i);