--- a/sys/bus/u4b/wlan/if_run.c	2026-10-01 18:36:08.405384357 +0000
+++ b/sys/bus/u4b/wlan/if_run.c	2026-10-01 18:36:29.945107939 +0000
@@ -1046,8 +1046,9 @@
 
 	/* call cmdq[].func locked */
 	RUN_LOCK(sc);
-	for (i = sc->cmdq_exec; sc->cmdq[i].func && pending;
-	    i = sc->cmdq_exec, pending--) {
+	for (i = sc->cmdq_exec; pending; i = sc->cmdq_exec, pending--) {
+		if (sc->cmdq[i].func == NULL)
+			break;
 		DPRINTFN(6, "cmdq_exec=%d pending=%d\n", i, pending);
 		if (sc->cmdq_run == RUN_CMDQ_GO) {
 			/*
@@ -2367,11 +2368,12 @@
 
 	i = RUN_CMDQ_GET(&sc->cmdq_store);
 	DPRINTF("cmdq_store=%d\n", i);
-	sc->cmdq[i].func = run_key_set_cb;
 	sc->cmdq[i].arg0 = NULL;
 	sc->cmdq[i].arg1 = vap;
 	sc->cmdq[i].k = k;
 	IEEE80211_ADDR_COPY(sc->cmdq[i].mac, k->wk_macaddr);
+	cpu_ccfence();			/* publish args before func */
+	sc->cmdq[i].func = run_key_set_cb;
 	ieee80211_runtask(ic, &sc->cmdq_task);
 
 	/*
@@ -2442,7 +2444,6 @@
 	 */
 	i = RUN_CMDQ_GET(&sc->cmdq_store);
 	DPRINTF("cmdq_store=%d\n", i);
-	sc->cmdq[i].func = run_key_delete_cb;
 	sc->cmdq[i].arg0 = NULL;
 	sc->cmdq[i].arg1 = sc;
 	k0 = &sc->cmdq[i].key;
@@ -2450,6 +2451,8 @@
 	k0->wk_keyix = k->wk_keyix;
 	/* matching wcid was written to wk_pad in run_key_set() */
 	k0->wk_pad = k->wk_pad;
+	cpu_ccfence();			/* publish args before func */
+	sc->cmdq[i].func = run_key_delete_cb;
 	ieee80211_runtask(ic, &sc->cmdq_task);
 	return (1);	/* return fake success */
 
@@ -2668,10 +2671,11 @@
 		 */
 		uint32_t cnt = RUN_CMDQ_GET(&sc->cmdq_store);
 		DPRINTF("cmdq_store=%d\n", cnt);
-		sc->cmdq[cnt].func = run_newassoc_cb;
 		sc->cmdq[cnt].arg0 = NULL;
 		sc->cmdq[cnt].arg1 = ni;
 		sc->cmdq[cnt].wcid = wcid;
+		cpu_ccfence();		/* publish args before func */
+		sc->cmdq[cnt].func = run_newassoc_cb;
 		ieee80211_runtask(ic, &sc->cmdq_task);
 	}
 
@@ -3156,8 +3160,9 @@
 				device_printf(sc->sc_dev, "device timeout\n");
 				uint32_t i = RUN_CMDQ_GET(&sc->cmdq_store);
 				DPRINTF("cmdq_store=%d\n", i);
-				sc->cmdq[i].func = run_usb_timeout_cb;
 				sc->cmdq[i].arg0 = vap;
+				cpu_ccfence();	/* publish args before func */
+				sc->cmdq[i].func = run_usb_timeout_cb;
 				ieee80211_runtask(ic, &sc->cmdq_task);
 			}
 
@@ -3424,8 +3429,9 @@
 			 */
 			uint32_t i = RUN_CMDQ_GET(&sc->cmdq_store);
 			DPRINTFN(6, "cmdq_store=%d\n", i);
-			sc->cmdq[i].func = run_drain_fifo;
 			sc->cmdq[i].arg0 = sc;
+			cpu_ccfence();	/* publish args before func */
+			sc->cmdq[i].func = run_drain_fifo;
 			ieee80211_runtask(ic, &sc->cmdq_task);
 		}
 	}
@@ -4893,8 +4899,9 @@
 
 	i = RUN_CMDQ_GET(&sc->cmdq_store);
 	DPRINTF("cmdq_store=%d\n", i);
-	sc->cmdq[i].func = run_update_beacon_cb;
 	sc->cmdq[i].arg0 = vap;
+	cpu_ccfence();		/* publish args before func */
+	sc->cmdq[i].func = run_update_beacon_cb;
 	ieee80211_runtask(ic, &sc->cmdq_task);
 
 	return;
@@ -4959,8 +4966,9 @@
 
 	i = RUN_CMDQ_GET(&sc->cmdq_store);
 	DPRINTF("cmdq_store=%d\n", i);
-	sc->cmdq[i].func = run_updateprot_cb;
 	sc->cmdq[i].arg0 = ic;
+	cpu_ccfence();		/* publish args before func */
+	sc->cmdq[i].func = run_updateprot_cb;
 	ieee80211_runtask(ic, &sc->cmdq_task);
 }
 
@@ -5205,8 +5213,9 @@
 
 	i = RUN_CMDQ_GET(&sc->cmdq_store);
 	DPRINTF("cmdq_store=%d\n", i);
-	sc->cmdq[i].func = run_updateslot_cb;
 	sc->cmdq[i].arg0 = ic;
+	cpu_ccfence();		/* publish args before func */
+	sc->cmdq[i].func = run_updateslot_cb;
 	ieee80211_runtask(ic, &sc->cmdq_task);
 
 	return;