Index: head/sys/dev/iwn/if_iwn.c
===================================================================
--- head/sys/dev/iwn/if_iwn.c
+++ head/sys/dev/iwn/if_iwn.c
@@ -4852,6 +4852,7 @@
 			if_inc_counter(ni->ni_vap->iv_ifp,
 			    IFCOUNTER_OERRORS, 1);
 			ieee80211_free_node(ni);
+			m_freem(m);
 		}
 	}
 
@@ -4872,16 +4873,13 @@
 
 	DPRINTF(sc, IWN_DEBUG_XMIT | IWN_DEBUG_TRACE, "->%s begin\n", __func__);
 
+	IWN_LOCK(sc);
 	if ((sc->sc_flags & IWN_FLAG_RUNNING) == 0) {
 		m_freem(m);
-		return ENETDOWN;
+		IWN_UNLOCK(sc);
+		return (ENETDOWN);
 	}
 
-	/* XXX? net80211 doesn't set this on xmit'ed raw frames? */
-	m->m_pkthdr.rcvif = (void *) ni;
-
-	IWN_LOCK(sc);
-
 	/* queue frame if we have to */
 	if (sc->sc_beacon_wait) {
 		if (iwn_xmit_queue_enqueue(sc, m) != 0) {
@@ -4909,12 +4907,14 @@
 	}
 	if (error == 0)
 		sc->sc_tx_timer = 5;
+	else
+		m_freem(m);
 
 	IWN_UNLOCK(sc);
 
 	DPRINTF(sc, IWN_DEBUG_TRACE | IWN_DEBUG_XMIT, "->%s: end\n",__func__);
 
-	return error;
+	return (error);
 }
 
 /*