--- a/sys/bus/u4b/wlan/if_run.c	2026-10-01 18:36:08.405384357 +0000
+++ b/sys/bus/u4b/wlan/if_run.c	2026-10-01 18:36:29.941107989 +0000
@@ -2507,12 +2507,19 @@
 	uint16_t (*wstat)[3];
 	uint8_t wcid, mcs, pid;
 	int8_t retry;
+	int ntries;
 
 	RUN_LOCK_ASSERT(sc, MA_OWNED);
 
-	for (;;) {
+	/*
+	 * DF-5248: the FIFO holds at most 16 entries; bound the loop and
+	 * stop on read errors (run_read() yields 0xffffffff on failure,
+	 * which has RT2860_TXQ_VLD set and would loop forever).
+	 */
+	for (ntries = 0; ntries < 32; ntries++) {
 		/* drain Tx status FIFO (maxsize = 16) */
-		run_read(sc, RT2860_TX_STAT_FIFO, &stat);
+		if (run_read(sc, RT2860_TX_STAT_FIFO, &stat) != 0)
+			break;
 		DPRINTFN(4, "tx stat 0x%08x\n", stat);
 		if (!(stat & RT2860_TXQ_VLD))
 			break;