Index: head/sys/dev/wpi/if_wpi.c
===================================================================
--- head/sys/dev/wpi/if_wpi.c
+++ head/sys/dev/wpi/if_wpi.c
@@ -3001,14 +3001,6 @@
 	return retval;
 }
 
-static __inline void
-wpi_handle_tx_failure(struct ieee80211_node *ni)
-{
-	/* NB: m is reclaimed on tx failure */
-	if_inc_counter(ni->ni_vap->iv_ifp, IFCOUNTER_OERRORS, 1);
-	ieee80211_free_node(ni);
-}
-
 static int
 wpi_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
     const struct ieee80211_bpf_params *params)
@@ -3046,8 +3038,8 @@
 unlock:	WPI_TX_UNLOCK(sc);
 
 	if (error != 0) {
-		wpi_handle_tx_failure(ni);
 		m_freem(m);
+		ieee80211_free_node(ni);
 		DPRINTF(sc, WPI_DEBUG_TRACE, TRACE_STR_END_ERR, __func__);
 
 		return error;
@@ -3085,7 +3077,8 @@
 	error = 0;
 	ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
 	if (wpi_tx_data(sc, m, ni) != 0) {
-		wpi_handle_tx_failure(ni);
+		if_inc_counter(ni->ni_vap->iv_ifp, IFCOUNTER_OERRORS, 1);
+		ieee80211_free_node(ni);
 		m_freem(m);
 	}