--- a/sys/bus/u4b/wlan/if_mtwvar.h
+++ b/sys/bus/u4b/wlan/if_mtwvar.h
@@ -34,7 +34,13 @@
 #define MTW_TXQ_COUNT		6
 
 #define MTW_WCID_MAX		64
-#define MTW_AID2WCID(aid)	(1 + ((aid) & 0x7))
+/*
+ * The WCID tables are MTW_WCID_MAX+1 entries; hashing 64 AIDs into 8
+ * WCIDs makes the 9th+ station overwrite another station's pairwise
+ * key (cross-station key confusion).  Use the AID directly and cap the
+ * vap AID space accordingly (iv_max_aid = MTW_WCID_MAX - 1).
+ */
+#define MTW_AID2WCID(aid)	(1 + (aid))
 
 struct mtw_rx_radiotap_header {
 	struct ieee80211_radiotap_header wr_ihdr;
--- a/sys/bus/u4b/wlan/if_mtw.c
+++ b/sys/bus/u4b/wlan/if_mtw.c
@@ -817,7 +817,7 @@
 	}
 
 	vap->iv_update_beacon = mtw_update_beacon;
-	vap->iv_max_aid = MTW_WCID_MAX;
+	vap->iv_max_aid = MTW_WCID_MAX - 1;	/* WCID0 is reserved */
 
 	/*
 	 * The linux rt2800 driver limits 1 stream devices to a 32KB