Index: sys/dev/ath/if_ath_tx.c
===================================================================
--- sys/dev/ath/if_ath_tx.c
+++ sys/dev/ath/if_ath_tx.c
@@ -2452,7 +2452,6 @@
 	ATH_KTR(sc, ATH_KTR_TX, 2, "ath_raw_xmit: bad0: m=%p, params=%p",
 	    m, params);
 	sc->sc_stats.ast_tx_raw_fail++;
-	ieee80211_free_node(ni);
 
 	return error;
 }
Index: sys/dev/bwi/if_bwi.c
===================================================================
--- sys/dev/bwi/if_bwi.c
+++ sys/dev/bwi/if_bwi.c
@@ -1399,7 +1399,6 @@
 	int idx, error;
 
 	if ((sc->sc_flags & BWI_F_RUNNING) == 0) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		return ENETDOWN;
 	}
@@ -1424,9 +1423,7 @@
 		tbd->tbd_used++;
 		tbd->tbd_idx = (idx + 1) % BWI_TX_NDESC;
 		sc->sc_tx_timer = 5;
-	} else
-		/* NB: m is reclaimed on encap failure */
-		ieee80211_free_node(ni);
+	}
 	BWI_UNLOCK(sc);
 	return error;
 }
Index: sys/dev/bwn/if_bwn.c
===================================================================
--- sys/dev/bwn/if_bwn.c
+++ sys/dev/bwn/if_bwn.c
@@ -2684,29 +2684,26 @@
 	struct ieee80211com *ic = ni->ni_ic;
 	struct bwn_softc *sc = ic->ic_softc;
 	struct bwn_mac *mac = sc->sc_curmac;
+	int error;
 
 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
 	    mac->mac_status < BWN_MAC_STATUS_STARTED) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		return (ENETDOWN);
 	}
 
 	BWN_LOCK(sc);
 	if (bwn_tx_isfull(sc, m)) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		BWN_UNLOCK(sc);
 		return (ENOBUFS);
 	}
 
-	if (bwn_tx_start(sc, ni, m) != 0) {
-		if (ni != NULL)
-			ieee80211_free_node(ni);
-	}
-	sc->sc_watchdog_timer = 5;
+	error = bwn_tx_start(sc, ni, m);
+	if (error == 0)
+		sc->sc_watchdog_timer = 5;
 	BWN_UNLOCK(sc);
-	return (0);
+	return (error);
 }
 
 /*
Index: sys/dev/iwm/if_iwm.c
===================================================================
--- sys/dev/iwm/if_iwm.c
+++ sys/dev/iwm/if_iwm.c
@@ -2877,7 +2877,6 @@
 	    "->%s begin\n", __func__);
 
 	if ((sc->sc_flags & IWM_FLAG_HW_INITED) == 0) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		IWM_DPRINTF(sc, IWM_DEBUG_XMIT,
 		    "<-%s not RUNNING\n", __func__);
@@ -2891,10 +2890,6 @@
 	} else {
 		error = iwm_tx(sc, m, ni, 0);
 	}
-	if (error != 0) {
-		/* NB: m is reclaimed on tx failure */
-		ieee80211_free_node(ni);
-	}
 	sc->sc_tx_timer = 5;
 	IWM_UNLOCK(sc);
 
Index: sys/dev/iwn/if_iwn.c
===================================================================
--- sys/dev/iwn/if_iwn.c
+++ sys/dev/iwn/if_iwn.c
@@ -4875,7 +4875,6 @@
 	DPRINTF(sc, IWN_DEBUG_XMIT | IWN_DEBUG_TRACE, "->%s begin\n", __func__);
 
 	if ((sc->sc_flags & IWN_FLAG_RUNNING) == 0) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		return ENETDOWN;
 	}
@@ -4889,9 +4888,6 @@
 	if (sc->sc_beacon_wait) {
 		if (iwn_xmit_queue_enqueue(sc, m) != 0) {
 			m_freem(m);
-			if_inc_counter(ni->ni_vap->iv_ifp,
-			    IFCOUNTER_OERRORS, 1);
-			ieee80211_free_node(ni);
 			IWN_UNLOCK(sc);
 			return (ENOBUFS);
 		}
@@ -4913,10 +4909,7 @@
 		 */
 		error = iwn_tx_data_raw(sc, m, ni, params);
 	}
-	if (error != 0) {
-		/* NB: m is reclaimed on tx failure */
-		ieee80211_free_node(ni);
-	} else
+	if (error == 0)
 		sc->sc_tx_timer = 5;
 
 	IWN_UNLOCK(sc);
Index: sys/dev/malo/if_malo.c
===================================================================
--- sys/dev/malo/if_malo.c
+++ sys/dev/malo/if_malo.c
@@ -1786,7 +1786,6 @@
 	struct malo_txq *txq;
 
 	if (!sc->malo_running || sc->malo_invalid) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		return ENETDOWN;
 	}
@@ -1800,7 +1799,6 @@
 	txq = &sc->malo_txq[0];
 	bf = malo_getbuf(sc, txq);
 	if (bf == NULL) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		return ENOBUFS;
 	}
@@ -1816,7 +1814,6 @@
 		txq->nfree++;
 		MALO_TXQ_UNLOCK(txq);
 
-		ieee80211_free_node(ni);
 		return EIO;		/* XXX */
 	}
 
Index: sys/dev/mwl/if_mwl.c
===================================================================
--- sys/dev/mwl/if_mwl.c
+++ sys/dev/mwl/if_mwl.c
@@ -1422,7 +1422,6 @@
 	struct mwl_txq *txq;
 
 	if (!sc->sc_running || sc->sc_invalid) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		return ENETDOWN;
 	}
@@ -1438,7 +1437,6 @@
 	bf = mwl_gettxbuf(sc, txq);
 	if (bf == NULL) {
 		sc->sc_stats.mst_tx_qstop++;
-		ieee80211_free_node(ni);
 		m_freem(m);
 		return ENOBUFS;
 	}
@@ -1448,7 +1446,6 @@
 	if (mwl_tx_start(sc, ni, bf, m)) {
 		mwl_puttxbuf_head(txq, bf);
 
-		ieee80211_free_node(ni);
 		return EIO;		/* XXX */
 	}
 	/*
Index: sys/dev/otus/if_otus.c
===================================================================
--- sys/dev/otus/if_otus.c
+++ sys/dev/otus/if_otus.c
@@ -567,7 +567,6 @@
 	if (bf)
 		otus_freebuf(sc, bf);
 	OTUS_UNLOCK(sc);
-	ieee80211_free_node(ni);
 	m_freem(m);
 	return (ENXIO);
 }
Index: sys/dev/ral/rt2560.c
===================================================================
--- sys/dev/ral/rt2560.c
+++ sys/dev/ral/rt2560.c
@@ -2711,13 +2711,11 @@
 	if (!(sc->sc_flags & RT2560_F_RUNNING)) {
 		RAL_UNLOCK(sc);
 		m_freem(m);
-		ieee80211_free_node(ni);
 		return ENETDOWN;
 	}
 	if (sc->prioq.queued >= RT2560_PRIO_RING_COUNT) {
 		RAL_UNLOCK(sc);
 		m_freem(m);
-		ieee80211_free_node(ni);
 		return ENOBUFS;		/* XXX */
 	}
 
@@ -2742,7 +2740,6 @@
 
 	return 0;
 bad:
-	ieee80211_free_node(ni);
 	RAL_UNLOCK(sc);
 	return EIO;		/* XXX */
 }
Index: sys/dev/ral/rt2661.c
===================================================================
--- sys/dev/ral/rt2661.c
+++ sys/dev/ral/rt2661.c
@@ -1636,13 +1636,11 @@
 	if (!(sc->sc_flags & RAL_RUNNING)) {
 		RAL_UNLOCK(sc);
 		m_freem(m);
-		ieee80211_free_node(ni);
 		return ENETDOWN;
 	}
 	if (sc->mgtq.queued >= RT2661_MGT_RING_COUNT) {
 		RAL_UNLOCK(sc);
 		m_freem(m);
-		ieee80211_free_node(ni);
 		return ENOBUFS;		/* XXX */
 	}
 
@@ -1659,7 +1657,6 @@
 
 	return 0;
 bad:
-	ieee80211_free_node(ni);
 	RAL_UNLOCK(sc);
 	return EIO;		/* XXX */
 }
Index: sys/dev/ral/rt2860.c
===================================================================
--- sys/dev/ral/rt2860.c
+++ sys/dev/ral/rt2860.c
@@ -1702,7 +1702,6 @@
 	if (!(sc->sc_flags & RT2860_RUNNNING)) {
 		RAL_UNLOCK(sc);
 		m_freem(m);
-		ieee80211_free_node(ni);
 		return ENETDOWN;
 	}
 	if (params == NULL) {
@@ -1718,10 +1717,6 @@
 		 */
 		error = rt2860_tx_raw(sc, m, ni, params);
 	}
-	if (error != 0) {
-		/* NB: m is reclaimed on tx failure */
-		ieee80211_free_node(ni);
-	}
 	sc->sc_tx_timer = 5;
 	RAL_UNLOCK(sc);
 	return error;
Index: sys/dev/usb/wlan/if_rsu.c
===================================================================
--- sys/dev/usb/wlan/if_rsu.c
+++ sys/dev/usb/wlan/if_rsu.c
@@ -2753,19 +2753,16 @@
 	/* prevent management frames from being sent if we're not ready */
 	if (!sc->sc_running) {
 		m_freem(m);
-		ieee80211_free_node(ni);
 		return (ENETDOWN);
 	}
 	RSU_LOCK(sc);
 	bf = rsu_getbuf(sc);
 	if (bf == NULL) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		RSU_UNLOCK(sc);
 		return (ENOBUFS);
 	}
 	if (rsu_tx_start(sc, ni, m, bf) != 0) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		rsu_freebuf(sc, bf);
 		RSU_UNLOCK(sc);
Index: sys/dev/usb/wlan/if_rum.c
===================================================================
--- sys/dev/usb/wlan/if_rum.c
+++ sys/dev/usb/wlan/if_rum.c
@@ -2844,7 +2844,6 @@
 bad:
 	RUM_UNLOCK(sc);
 	m_freem(m);
-	ieee80211_free_node(ni);
 	return ret;
 }
 
Index: sys/dev/usb/wlan/if_run.c
===================================================================
--- sys/dev/usb/wlan/if_run.c
+++ sys/dev/usb/wlan/if_run.c
@@ -3689,7 +3689,6 @@
 	if (error != 0) {
 		if(m != NULL)
 			m_freem(m);
-		ieee80211_free_node(ni);
 	}
 
 	return (error);
Index: sys/dev/usb/wlan/if_uath.c
===================================================================
--- sys/dev/usb/wlan/if_uath.c
+++ sys/dev/usb/wlan/if_uath.c
@@ -1781,7 +1781,6 @@
 	if ((sc->sc_flags & UATH_FLAG_INVALID) ||
 	    !(sc->sc_flags & UATH_FLAG_INITDONE)) {
 		m_freem(m);
-		ieee80211_free_node(ni);
 		UATH_UNLOCK(sc);
 		return (ENETDOWN);
 	}
@@ -1789,7 +1788,6 @@
 	/* grab a TX buffer  */
 	bf = uath_getbuf(sc);
 	if (bf == NULL) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		UATH_UNLOCK(sc);
 		return (ENOBUFS);
@@ -1797,7 +1795,6 @@
 
 	sc->sc_seqnum = 0;
 	if (uath_tx_start(sc, m, ni, bf) != 0) {
-		ieee80211_free_node(ni);
 		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
 		UATH_STAT_INC(sc, st_tx_inactive);
 		UATH_UNLOCK(sc);
Index: sys/dev/usb/wlan/if_upgt.c
===================================================================
--- sys/dev/usb/wlan/if_upgt.c
+++ sys/dev/usb/wlan/if_upgt.c
@@ -798,14 +798,12 @@
 	/* prevent management frames from being sent if we're not ready */
 	if (!(sc->sc_flags & UPGT_FLAG_INITDONE)) {
 		m_freem(m);
-		ieee80211_free_node(ni);
 		UPGT_UNLOCK(sc);
 		return ENETDOWN;
 	}
 
 	data_tx = upgt_gettxbuf(sc);
 	if (data_tx == NULL) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		UPGT_UNLOCK(sc);
 		return (ENOBUFS);
@@ -814,7 +812,6 @@
 	if (upgt_tx_start(sc, m, ni, data_tx) != 0) {
 		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, data_tx, next);
 		UPGT_STAT_INC(sc, st_tx_inactive);
-		ieee80211_free_node(ni);
 		UPGT_UNLOCK(sc);
 		return (EIO);
 	}
Index: sys/dev/usb/wlan/if_ural.c
===================================================================
--- sys/dev/usb/wlan/if_ural.c
+++ sys/dev/usb/wlan/if_ural.c
@@ -2122,13 +2122,11 @@
 	if (!sc->sc_running) {
 		RAL_UNLOCK(sc);
 		m_freem(m);
-		ieee80211_free_node(ni);
 		return ENETDOWN;
 	}
 	if (sc->tx_nfree < RAL_TX_MINFREE) {
 		RAL_UNLOCK(sc);
 		m_freem(m);
-		ieee80211_free_node(ni);
 		return EIO;
 	}
 
@@ -2151,7 +2149,6 @@
 	return 0;
 bad:
 	RAL_UNLOCK(sc);
-	ieee80211_free_node(ni);
 	return EIO;		/* XXX */
 }
 
Index: sys/dev/usb/wlan/if_urtw.c
===================================================================
--- sys/dev/usb/wlan/if_urtw.c
+++ sys/dev/usb/wlan/if_urtw.c
@@ -1527,20 +1527,17 @@
 	/* prevent management frames from being sent if we're not ready */
 	if (!(sc->sc_flags & URTW_RUNNING)) {
 		m_freem(m);
-		ieee80211_free_node(ni);
 		return ENETDOWN;
 	}
 	URTW_LOCK(sc);
 	bf = urtw_getbuf(sc);
 	if (bf == NULL) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		URTW_UNLOCK(sc);
 		return (ENOBUFS);		/* XXX */
 	}
 
 	if (urtw_tx_start(sc, ni, m, bf, URTW_PRIORITY_LOW) != 0) {
-		ieee80211_free_node(ni);
 		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
 		URTW_UNLOCK(sc);
 		return (EIO);
Index: sys/dev/usb/wlan/if_urtwn.c
===================================================================
--- sys/dev/usb/wlan/if_urtwn.c
+++ sys/dev/usb/wlan/if_urtwn.c
@@ -3461,13 +3461,11 @@
 	/* prevent management frames from being sent if we're not ready */
 	if (!(sc->sc_flags & URTWN_RUNNING)) {
 		m_freem(m);
-		ieee80211_free_node(ni);
 		return (ENETDOWN);
 	}
 	URTWN_LOCK(sc);
 	bf = urtwn_getbuf(sc);
 	if (bf == NULL) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		URTWN_UNLOCK(sc);
 		return (ENOBUFS);
@@ -3475,7 +3473,6 @@
 
 	if (urtwn_tx_start(sc, ni, m, bf) != 0) {
 		m_freem(m);
-		ieee80211_free_node(ni);
 		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
 		URTWN_UNLOCK(sc);
 		return (EIO);
Index: sys/dev/usb/wlan/if_zyd.c
===================================================================
--- sys/dev/usb/wlan/if_zyd.c
+++ sys/dev/usb/wlan/if_zyd.c
@@ -2574,13 +2574,11 @@
 	if (!(sc->sc_flags & ZYD_FLAG_RUNNING)) {
 		ZYD_UNLOCK(sc);
 		m_freem(m);
-		ieee80211_free_node(ni);
 		return (ENETDOWN);
 	}
 	if (sc->tx_nfree == 0) {
 		ZYD_UNLOCK(sc);
 		m_freem(m);
-		ieee80211_free_node(ni);
 		return (ENOBUFS);		/* XXX */
 	}
 
@@ -2591,7 +2589,6 @@
 	 */
 	if (zyd_tx_start(sc, m, ni) != 0) {
 		ZYD_UNLOCK(sc);
-		ieee80211_free_node(ni);
 		return (EIO);
 	}
 	ZYD_UNLOCK(sc);
Index: sys/dev/wi/if_wi.c
===================================================================
--- sys/dev/wi/if_wi.c
+++ sys/dev/wi/if_wi.c
@@ -1077,6 +1077,7 @@
 		goto out;
 	}
 	m0 = NULL;
+	ieee80211_free_node(ni);
 
 	sc->sc_txnext = cur = (cur + 1) % sc->sc_ntxbuf;
 out:
@@ -1084,7 +1085,6 @@
 
 	if (m0 != NULL)
 		m_freem(m0);
-	ieee80211_free_node(ni);
 	return rc;
 }
 
Index: sys/dev/wpi/if_wpi.c
===================================================================
--- sys/dev/wpi/if_wpi.c
+++ sys/dev/wpi/if_wpi.c
@@ -3100,7 +3100,6 @@
 
 	if (error != 0) {
 		m_freem(m);
-		ieee80211_free_node(ni);
 		DPRINTF(sc, WPI_DEBUG_TRACE, TRACE_STR_END_ERR, __func__);
 
 		return error;
Index: sys/net80211/ieee80211_output.c
===================================================================
--- sys/net80211/ieee80211_output.c
+++ sys/net80211/ieee80211_output.c
@@ -531,8 +531,10 @@
 		(void) ieee80211_add_xmit_params(m, params);
 
 	error = ic->ic_raw_xmit(ni, m, params);
-	if (error)
+	if (error) {
 		if_inc_counter(vap->iv_ifp, IFCOUNTER_OERRORS, 1);
+		ieee80211_free_node(ni);
+	}
 	return (error);
 }