diff --git a/sys/net80211/ieee80211_crypto_ccmp.c b/sys/net80211/ieee80211_crypto_ccmp.c
--- a/sys/net80211/ieee80211_crypto_ccmp.c
+++ b/sys/net80211/ieee80211_crypto_ccmp.c
@@ -278,7 +278,7 @@
 	 * latter we leave the header in place for use in the
 	 * decryption work.
 	 */
-	if ((k->wk_flags & IEEE80211_KEY_SWDECRYPT) &&
+	if (((rxs == NULL) || (rxs->c_pktflags & IEEE80211_RX_F_DECRYPTED) == 0) &&
 	    !ccmp_decrypt(k, pn, m, hdrlen))
 		return 0;
 
diff --git a/sys/net80211/ieee80211_crypto_tkip.c b/sys/net80211/ieee80211_crypto_tkip.c
--- a/sys/net80211/ieee80211_crypto_tkip.c
+++ b/sys/net80211/ieee80211_crypto_tkip.c
@@ -350,7 +350,7 @@
 	 * If so we just strip the header; otherwise we need to
 	 * handle the decrypt in software.
 	 */
-	if ((k->wk_flags & IEEE80211_KEY_SWDECRYPT) &&
+	if (((rxs == NULL) || (rxs->c_pktflags & IEEE80211_RX_F_DECRYPTED) == 0) &&
 	    !tkip_decrypt(ctx, k, m, hdrlen))
 		return 0;
 
diff --git a/sys/net80211/ieee80211_crypto_wep.c b/sys/net80211/ieee80211_crypto_wep.c
--- a/sys/net80211/ieee80211_crypto_wep.c
+++ b/sys/net80211/ieee80211_crypto_wep.c
@@ -251,7 +251,7 @@
 	 * If so we just strip the header; otherwise we need to
 	 * handle the decrypt in software.
 	 */
-	if ((k->wk_flags & IEEE80211_KEY_SWDECRYPT) &&
+	if (((rxs == NULL) || (rxs->c_pktflags & IEEE80211_RX_F_DECRYPTED) == 0) &&
 	    !wep_decrypt(k, m, hdrlen)) {
 #ifdef IEEE80211_DEBUG
 		struct ieee80211_frame *wh;