--- a/sys/bus/u4b/wlan/if_mtw.c
+++ b/sys/bus/u4b/wlan/if_mtw.c
@@ -1934,10 +1934,16 @@
 
 	i = MTW_CMDQ_GET(&sc->cmdq_store);
 	MTW_DPRINTF(sc, MTW_DEBUG_KEY, "cmdq_store=%d\n", i);
+	/*
+	 * Pairwise keys are embedded in the ieee80211_node and can be
+	 * freed before the task runs: copy the key instead of deferring
+	 * the raw pointer (same approach as mtw_key_delete()).
+	 */
+	sc->cmdq[i].key = *k;
 	sc->cmdq[i].func = mtw_key_set_cb;
 	sc->cmdq[i].arg0 = NULL;
 	sc->cmdq[i].arg1 = vap;
-	sc->cmdq[i].k = k;
+	sc->cmdq[i].k = &sc->cmdq[i].key;
 	IEEE80211_ADDR_COPY(sc->cmdq[i].mac, k->wk_macaddr);
 	ieee80211_runtask(ic, &sc->cmdq_task);