diff --git a/sys/dev/iwx/if_iwx.c b/sys/dev/iwx/if_iwx.c
--- a/sys/dev/iwx/if_iwx.c
+++ b/sys/dev/iwx/if_iwx.c
@@ -4805,6 +4805,8 @@
 static void
 iwx_clear_oactive(struct iwx_softc *sc, struct iwx_tx_ring *ring)
 {
+	IWX_ASSERT_LOCKED(sc);
+
 	if (ring->queued < iwx_lomark) {
 		sc->qfullmsk &= ~(1 << ring->qid);
 		if (sc->qfullmsk == 0 /* && ifq_is_oactive(&ifp->if_snd) */) {
@@ -5630,6 +5632,8 @@
 	struct mbuf *m1;
 	size_t txcmd_size;
 
+	IWX_ASSERT_LOCKED(sc);
+
 	wh = mtod(m, struct ieee80211_frame *);
 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
@@ -8534,6 +8538,8 @@
         struct ieee80211_node *ni;
         struct mbuf *m;
 
+        IWX_ASSERT_LOCKED(sc);
+
         while (sc->qfullmsk == 0 && (m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
                 ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
                 if (iwx_tx(sc, m, ni) != 0) {