--- a/sys/bus/u4b/wlan/if_run.c	2026-10-01 18:36:08.405384357 +0000
+++ b/sys/bus/u4b/wlan/if_run.c	2026-10-01 18:36:29.925108196 +0000
@@ -1025,6 +1025,14 @@
 
 	RUN_UNLOCK(sc);
 
+	/*
+	 * DF-5247: cmdq/ratectl entries may still hold pointers to this
+	 * vap; ieee80211_vap_detach() drains only iv_nstate_task and
+	 * iv_swbmiss_task, so drain our tasks here, before the free.
+	 */
+	ieee80211_draintask(ic, &sc->cmdq_task);
+	ieee80211_draintask(ic, &sc->ratectl_task);
+
 	ieee80211_ratectl_deinit(vap);
 	ieee80211_vap_detach(vap);
 	kfree(rvp, M_80211_VAP);