Index: head/sys/dev/iwn/if_iwn.c
===================================================================
--- head/sys/dev/iwn/if_iwn.c
+++ head/sys/dev/iwn/if_iwn.c
@@ -235,6 +235,7 @@
 static int	iwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
 		    const struct ieee80211_bpf_params *);
 static int	iwn_transmit(struct ieee80211com *, struct mbuf *);
+static void	iwn_scan_timeout(void *);
 static void	iwn_watchdog(void *);
 static int	iwn_ioctl(struct ieee80211com *, u_long , void *);
 static void	iwn_parent(struct ieee80211com *);
@@ -675,6 +676,7 @@
 	iwn_radiotap_attach(sc);
 
 	callout_init_mtx(&sc->calib_to, &sc->sc_mtx, 0);
+	callout_init_mtx(&sc->scan_timeout, &sc->sc_mtx, 0);
 	callout_init_mtx(&sc->watchdog_to, &sc->sc_mtx, 0);
 	TASK_INIT(&sc->sc_radioon_task, 0, iwn_radio_on, sc);
 	TASK_INIT(&sc->sc_radiooff_task, 0, iwn_radio_off, sc);
@@ -1406,6 +1408,7 @@
 		taskqueue_free(sc->sc_tq);
 
 		callout_drain(&sc->watchdog_to);
+		callout_drain(&sc->scan_timeout);
 		callout_drain(&sc->calib_to);
 		ieee80211_ifdetach(&sc->sc_ic);
 	}
@@ -3937,6 +3940,7 @@
 			    scan->nchan, scan->status, scan->chan);
 #endif
 			sc->sc_is_scanning = 0;
+			callout_stop(&sc->scan_timeout);
 			IWN_UNLOCK(sc);
 			ieee80211_scan_next(vap);
 			IWN_LOCK(sc);
@@ -4955,6 +4959,16 @@
 }
 
 static void
+iwn_scan_timeout(void *arg)
+{
+	struct iwn_softc *sc = arg;
+	struct ieee80211com *ic = &sc->sc_ic;
+
+	ic_printf(ic, "scan timeout\n");
+	ieee80211_restart_all(ic);
+}
+
+static void
 iwn_watchdog(void *arg)
 {
 	struct iwn_softc *sc = arg;
@@ -6972,6 +6986,8 @@
 	    hdr->nchan);
 	error = iwn_cmd(sc, IWN_CMD_SCAN, buf, buflen, 1);
 	free(buf, M_DEVBUF);
+	if (error == 0)
+		callout_reset(&sc->scan_timeout, 5*hz, iwn_scan_timeout, sc);
 
 	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
 
Index: head/sys/dev/iwn/if_iwnvar.h
===================================================================
--- head/sys/dev/iwn/if_iwnvar.h
+++ head/sys/dev/iwn/if_iwnvar.h
@@ -317,6 +317,7 @@
 	int			calib_cnt;
 	struct iwn_calib_state	calib;
 	int			last_calib_ticks;
+	struct callout		scan_timeout;
 	struct callout		watchdog_to;
 	struct iwn_fw_info	fw;
 	struct iwn_calib_info	calibcmd[IWN5000_PHY_CALIB_MAX_RESULT];
@@ -378,7 +379,6 @@
 	uint8_t			chainmask;
 
 	int			sc_tx_timer;
-	int			sc_scan_timer;
 
 	/* Are we doing a scan? */
 	int			sc_is_scanning;