--- a/sys/bus/u4b/wlan/if_rum.c
+++ b/sys/bus/u4b/wlan/if_rum.c
@@ -711,8 +711,11 @@
 {
 	struct rum_vap *rvp = RUM_VAP(vap);
 	struct ieee80211com *ic = vap->iv_ic;
+	struct rum_softc *sc = ic->ic_softc;
 
+	RUM_LOCK(sc);
 	m_freem(rvp->bcn_mbuf);
+	RUM_UNLOCK(sc);
 	usb_callout_drain(&rvp->ratectl_ch);
 	ieee80211_draintask(ic, &rvp->ratectl_task);
 	ieee80211_ratectl_deinit(vap);
@@ -2822,10 +2825,12 @@
 	default:
 		break;
 	}
-	RUM_UNLOCK(sc);
 
 	setbit(bo->bo_flags, item);
+	/* Hold RUM_LOCK across the in-mbuf writes: rum_newstate() and
+	 * rum_vap_delete() free/replace bcn_mbuf in the sc-lock domain. */
 	ieee80211_beacon_update(ni, m, mcast);
+	RUM_UNLOCK(sc);
 
 	rum_cmd_sleepable(sc, &vap, sizeof(vap), 0, rum_update_beacon_cb);
 }