--- a/sys/bus/u4b/wlan/if_mtw.c
+++ b/sys/bus/u4b/wlan/if_mtw.c
@@ -904,6 +904,13 @@
 
 	MTW_UNLOCK(sc);
 
+	/*
+	 * Drain deferred cmdq entries that still hold raw vap/ni pointers
+	 * (mtw_update_beacon arg0=vap, mtw_newassoc arg1=ni, mtw_key_set
+	 * arg1=vap) before the vap memory is freed below.
+	 */
+	ieee80211_draintask(ic, &sc->cmdq_task);
+
 	ieee80211_ratectl_deinit(vap);
 	ieee80211_vap_detach(vap);
 	kfree(rvp, M_80211_VAP);