diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c
--- a/sys/compat/linuxkpi/common/src/linux_80211.c
+++ b/sys/compat/linuxkpi/common/src/linux_80211.c
@@ -6467,14 +6467,16 @@
 		if (rx_status->flag & RX_FLAG_PN_VALIDATED)
 			rx_stats->c_pktflags |= IEEE80211_RX_F_PN_VALIDATED;
 	}
+	if (rx_status->flag & RX_FLAG_IV_STRIPPED)
+		rx_stats->c_pktflags |= IEEE80211_RX_F_IV_STRIP;
+	if (rx_status->flag & RX_FLAG_ICV_STRIPPED)
+		rx_stats->c_pktflags |= IEEE80211_RX_F_ICV_STRIP;
+	if (rx_status->flag & RX_FLAG_MIC_STRIPPED)
+		rx_stats->c_pktflags |= IEEE80211_RX_F_MIC_STRIP;
 	if (rx_status->flag & RX_FLAG_MMIC_STRIPPED)
 		rx_stats->c_pktflags |= IEEE80211_RX_F_MMIC_STRIP;
 	if (rx_status->flag & RX_FLAG_MMIC_ERROR)
 		rx_stats->c_pktflags |= IEEE80211_RX_F_FAIL_MMIC;
-	if (rx_status->flag & RX_FLAG_MIC_STRIPPED)
-		rx_stats->c_pktflags |= IEEE80211_RX_F_MIC_STRIP;
-	if (rx_status->flag & RX_FLAG_IV_STRIPPED)
-		rx_stats->c_pktflags |= IEEE80211_RX_F_IV_STRIP;
 	if (rx_status->flag & RX_FLAG_FAILED_FCS_CRC)
 		rx_stats->c_pktflags |= IEEE80211_RX_F_FAIL_FCSCRC;
 #endif
diff --git a/sys/net80211/_ieee80211.h b/sys/net80211/_ieee80211.h
--- a/sys/net80211/_ieee80211.h
+++ b/sys/net80211/_ieee80211.h
@@ -596,6 +596,7 @@
 #define	IEEE80211_RX_F_VHT		0x00008000
 #define	IEEE80211_RX_F_PN_VALIDATED	0x00010000 /* Decrypted; PN validated */
 #define	IEEE80211_RX_F_MIC_STRIP	0x00020000 /* Decrypted; MIC stripped */
+#define	IEEE80211_RX_F_ICV_STRIP	0x00040000 /* Decrypted: ICV (ic_trailer) stripped */
 
 /* Channel width */
 #define	IEEE80211_RX_FW_20MHZ		1
diff --git a/sys/net80211/ieee80211_crypto_tkip.c b/sys/net80211/ieee80211_crypto_tkip.c
--- a/sys/net80211/ieee80211_crypto_tkip.c
+++ b/sys/net80211/ieee80211_crypto_tkip.c
@@ -361,16 +361,17 @@
 	 * are required to.
 	 */
 	if (! ((rxs != NULL) && (rxs->c_pktflags & IEEE80211_RX_F_IV_STRIP))) {
+		/* XXX this assumes the header + IV are contiguous in an mbuf. */
 		memmove(mtod(m, uint8_t *) + tkip.ic_header, mtod(m, void *),
 		    hdrlen);
 		m_adj(m, tkip.ic_header);
 	}
 
 	/*
-	 * XXX TODO: do we need an option to potentially not strip the
-	 * WEP trailer?  Does "MMIC_STRIP" also mean this? Or?
+	 * Strip the ICV if hardware has not done so already.
 	 */
-	m_adj(m, -tkip.ic_trailer);
+	if (rxs != NULL && (rxs->c_pktflags & IEEE80211_RX_F_ICV_STRIP) == 0)
+		m_adj(m, -tkip.ic_trailer);
 
 	return 1;
 }
@@ -403,7 +404,7 @@
 	}
 
 	/*
-	 * If IV has been stripped, we skip most of the below.
+	 * If MMIC has been stripped, we skip most of the below.
 	 */
 	if ((rxs != NULL) && (rxs->c_pktflags & IEEE80211_RX_F_MMIC_STRIP))
 		goto finish;