--- a/sys/bus/u4b/wlan/if_rum.c
+++ b/sys/bus/u4b/wlan/if_rum.c
@@ -711,10 +711,17 @@
 {
 	struct rum_vap *rvp = RUM_VAP(vap);
 	struct ieee80211com *ic = vap->iv_ic;
+	struct rum_softc *sc = ic->ic_softc;
 
 	m_freem(rvp->bcn_mbuf);
 	usb_callout_drain(&rvp->ratectl_ch);
 	ieee80211_draintask(ic, &rvp->ratectl_task);
+	/*
+	 * Deferred cmdq entries may still hold this vap (e.g. the raw
+	 * vap pointer queued by rum_update_beacon()); drain them before
+	 * the vap memory is freed.
+	 */
+	ieee80211_draintask(ic, &sc->cmdq_task);
 	ieee80211_ratectl_deinit(vap);
 	ieee80211_vap_detach(vap);
 	kfree(rvp, M_80211_VAP);