--- a/sys/bus/u4b/wlan/if_rum.c
+++ b/sys/bus/u4b/wlan/if_rum.c
@@ -1475,10 +1475,6 @@
 
 	RUM_LOCK_ASSERT(sc);
 
-	data = STAILQ_FIRST(&sc->tx_free);
-	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
-	sc->tx_nfree--;
-
 	wh = mtod(m0, struct ieee80211_frame *);
 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
 	hdrlen = ieee80211_anyhdrsize(wh);
@@ -1496,6 +1492,12 @@
 		wh = mtod(m0, struct ieee80211_frame *);
 	}
 
+	/* Take the tx slot only after the frame passed validation:
+	 * the error paths above must not orphan a tx_free entry. */
+	data = STAILQ_FIRST(&sc->tx_free);
+	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
+	sc->tx_nfree--;
+
 	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
 
 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {