diff --git a/sys/net80211/ieee80211_adhoc.c b/sys/net80211/ieee80211_adhoc.c
--- a/sys/net80211/ieee80211_adhoc.c
+++ b/sys/net80211/ieee80211_adhoc.c
@@ -395,7 +395,8 @@
 		     (subtype == IEEE80211_FC0_SUBTYPE_BEACON ||
 		      subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)) &&
 		    !IEEE80211_ADDR_EQ(bssid, vap->iv_bss->ni_bssid) &&
-		    !IEEE80211_ADDR_EQ(bssid, ifp->if_broadcastaddr)) {
+		    !IEEE80211_ADDR_EQ(bssid,
+		        ieee80211_vap_get_broadcast_address(vap))) {
 			/* not interested in */
 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 			    bssid, NULL, "%s", "not to bss");
diff --git a/sys/net80211/ieee80211_freebsd.h b/sys/net80211/ieee80211_freebsd.h
--- a/sys/net80211/ieee80211_freebsd.h
+++ b/sys/net80211/ieee80211_freebsd.h
@@ -547,6 +547,7 @@
 bool ieee80211_vap_ifp_check_is_simplex(struct ieee80211vap *);
 bool ieee80211_vap_ifp_check_is_running(struct ieee80211vap *);
 void ieee80211_vap_ifp_set_running_state(struct ieee80211vap *, bool);
+const uint8_t * ieee80211_vap_get_broadcast_address(struct ieee80211vap *);
 
 #endif /* _KERNEL */
 
diff --git a/sys/net80211/ieee80211_freebsd.c b/sys/net80211/ieee80211_freebsd.c
--- a/sys/net80211/ieee80211_freebsd.c
+++ b/sys/net80211/ieee80211_freebsd.c
@@ -1314,6 +1314,18 @@
 		if_setdrvflagbits(vap->iv_ifp, 0, IFF_DRV_RUNNING);
 }
 
+/**
+ * @brief Return the broadcast MAC address.
+ *
+ * @param vap	The current VAP
+ * @retval a uint8_t array representing the ethernet broadcast address
+ */
+const uint8_t *
+ieee80211_vap_get_broadcast_address(struct ieee80211vap *vap)
+{
+	return (if_getbroadcastaddr(vap->iv_ifp));
+}
+
 /*
  * Module glue.
  *
diff --git a/sys/net80211/ieee80211_hostap.c b/sys/net80211/ieee80211_hostap.c
--- a/sys/net80211/ieee80211_hostap.c
+++ b/sys/net80211/ieee80211_hostap.c
@@ -557,9 +557,10 @@
 		 * Validate the bssid.
 		 */
 		if (!(type == IEEE80211_FC0_TYPE_MGT &&
-		      subtype == IEEE80211_FC0_SUBTYPE_BEACON) &&
+		    subtype == IEEE80211_FC0_SUBTYPE_BEACON) &&
 		    !IEEE80211_ADDR_EQ(bssid, vap->iv_bss->ni_bssid) &&
-		    !IEEE80211_ADDR_EQ(bssid, ifp->if_broadcastaddr)) {
+		    !IEEE80211_ADDR_EQ(bssid,
+		    ieee80211_vap_get_broadcast_address(vap))) {
 			/* not interested in */
 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 			    bssid, NULL, "%s", "not to bss");
@@ -1654,7 +1655,6 @@
 ieee80211_deliver_l2uf(struct ieee80211_node *ni)
 {
 	struct ieee80211vap *vap = ni->ni_vap;
-	struct ifnet *ifp = vap->iv_ifp;
 	struct mbuf *m;
 	struct l2_update_frame *l2uf;
 	struct ether_header *eh;
@@ -1669,7 +1669,8 @@
 	l2uf = mtod(m, struct l2_update_frame *);
 	eh = &l2uf->eh;
 	/* dst: Broadcast address */
-	IEEE80211_ADDR_COPY(eh->ether_dhost, ifp->if_broadcastaddr);
+	IEEE80211_ADDR_COPY(eh->ether_dhost,
+	    ieee80211_vap_get_broadcast_address(vap));
 	/* src: associated STA */
 	IEEE80211_ADDR_COPY(eh->ether_shost, ni->ni_macaddr);
 	eh->ether_type = htons(sizeof(*l2uf) - sizeof(*eh));
diff --git a/sys/net80211/ieee80211_ioctl.c b/sys/net80211/ieee80211_ioctl.c
--- a/sys/net80211/ieee80211_ioctl.c
+++ b/sys/net80211/ieee80211_ioctl.c
@@ -510,7 +510,8 @@
 	error = copyin(ireq->i_data, macaddr, IEEE80211_ADDR_LEN);
 	if (error != 0)
 		return error;
-	if (IEEE80211_ADDR_EQ(macaddr, vap->iv_ifp->if_broadcastaddr)) {
+	if (IEEE80211_ADDR_EQ(macaddr,
+	    ieee80211_vap_get_broadcast_address(vap))) {
 		ni = NULL;
 	} else {
 		ni = ieee80211_find_vap_node(&vap->iv_ic->ic_sta, vap, macaddr);
@@ -1371,7 +1372,8 @@
 	int error = 0;
 
 	/* NB: the broadcast address means do 'em all */
-	if (!IEEE80211_ADDR_EQ(mac, vap->iv_ifp->if_broadcastaddr)) {
+	if (!IEEE80211_ADDR_EQ(mac,
+	    ieee80211_vap_get_broadcast_address(vap))) {
 		IEEE80211_NODE_LOCK(nt);
 		ni = ieee80211_find_node_locked(nt, mac);
 		IEEE80211_NODE_UNLOCK(nt);
diff --git a/sys/net80211/ieee80211_output.c b/sys/net80211/ieee80211_output.c
--- a/sys/net80211/ieee80211_output.c
+++ b/sys/net80211/ieee80211_output.c
@@ -3662,7 +3662,6 @@
 {
 	struct ieee80211vap *vap = ni->ni_vap;
 	struct ieee80211com *ic = ni->ni_ic;
-	struct ifnet *ifp = vap->iv_ifp;
 	struct ieee80211_frame *wh;
 	struct mbuf *m;
 	int pktlen;
@@ -3764,7 +3763,8 @@
 	    IEEE80211_FC0_SUBTYPE_BEACON;
 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
 	*(uint16_t *)wh->i_dur = 0;
-	IEEE80211_ADDR_COPY(wh->i_addr1, ifp->if_broadcastaddr);
+	IEEE80211_ADDR_COPY(wh->i_addr1,
+	    ieee80211_vap_get_broadcast_address(vap));
 	IEEE80211_ADDR_COPY(wh->i_addr2, vap->iv_myaddr);
 	IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid);
 	*(uint16_t *)wh->i_seq = 0;
diff --git a/sys/net80211/ieee80211_scan_sw.c b/sys/net80211/ieee80211_scan_sw.c
--- a/sys/net80211/ieee80211_scan_sw.c
+++ b/sys/net80211/ieee80211_scan_sw.c
@@ -526,7 +526,6 @@
 {
 	struct ieee80211com *ic = vap->iv_ic;
 	struct ieee80211_scan_state *ss = ic->ic_scan;
-	struct ifnet *ifp = vap->iv_ifp;
 	int i;
 
 	/*
@@ -542,13 +541,15 @@
 	 */
 	for (i = 0; i < ss->ss_nssid; i++)
 		ieee80211_send_probereq(vap->iv_bss,
-			vap->iv_myaddr, ifp->if_broadcastaddr,
-			ifp->if_broadcastaddr,
+			vap->iv_myaddr,
+			ieee80211_vap_get_broadcast_address(vap),
+			ieee80211_vap_get_broadcast_address(vap),
 			ss->ss_ssid[i].ssid, ss->ss_ssid[i].len);
 	if ((ss->ss_flags & IEEE80211_SCAN_NOBCAST) == 0)
 		ieee80211_send_probereq(vap->iv_bss,
-			vap->iv_myaddr, ifp->if_broadcastaddr,
-			ifp->if_broadcastaddr,
+			vap->iv_myaddr,
+			ieee80211_vap_get_broadcast_address(vap),
+			ieee80211_vap_get_broadcast_address(vap),
 			"", 0);
 }
 
diff --git a/sys/net80211/ieee80211_wds.c b/sys/net80211/ieee80211_wds.c
--- a/sys/net80211/ieee80211_wds.c
+++ b/sys/net80211/ieee80211_wds.c
@@ -487,7 +487,8 @@
 	}
 	/* NB: the TA is implicitly verified by finding the wds peer node */
 	if (!IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr) &&
-	    !IEEE80211_ADDR_EQ(wh->i_addr1, ifp->if_broadcastaddr)) {
+	    !IEEE80211_ADDR_EQ(wh->i_addr1,
+	    ieee80211_vap_get_broadcast_address(vap))) {
 		/* not interested in */
 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 		    wh->i_addr1, NULL, "%s", "not to bss");