diff --git a/sys/net80211/ieee80211_output.c b/sys/net80211/ieee80211_output.c
--- a/sys/net80211/ieee80211_output.c
+++ b/sys/net80211/ieee80211_output.c
@@ -163,14 +163,7 @@
 		/* XXX better status? */
 		return (0);
 	}
-	/*
-	 * Stash the node pointer.  Note that we do this after
-	 * any call to ieee80211_dwds_mcast because that code
-	 * uses any existing value for rcvif to identify the
-	 * interface it (might have been) received on.
-	 */
 	MPASS((m->m_pkthdr.csum_flags & CSUM_SND_TAG) == 0);
-	m->m_pkthdr.rcvif = (void *)ni;
 	mcast = (m->m_flags & (M_MCAST | M_BCAST)) ? 1: 0;
 
 	BPF_MTAP(ifp, m);		/* 802.3 tx */
@@ -319,6 +312,15 @@
 			return (ENOBUFS);
 		}
 	}
+	/*
+	 * Stash the node pointer.  Note that we do this after
+	 * any call to ieee80211_dwds_mcast because that code
+	 * uses any existing value for rcvif to identify the
+	 * interface it (might have been) received on.
+	 * We also do this after any possible mbuf could have
+	 * been replaced.
+	 */
+	m->m_pkthdr.rcvif = (void *)ni;
 	(void) ieee80211_parent_xmitpkt(ic, m);
 
 	/*