Index: head/sys/dev/iwm/if_iwm_mac_ctxt.c
===================================================================
--- head/sys/dev/iwm/if_iwm_mac_ctxt.c
+++ head/sys/dev/iwm/if_iwm_mac_ctxt.c
@@ -275,7 +275,7 @@
 	 */
 	cmd->tsf_id = htole32(IWM_DEFAULT_TSFID);
 
-	IEEE80211_ADDR_COPY(cmd->node_addr, ic->ic_macaddr);
+	IEEE80211_ADDR_COPY(cmd->node_addr, vap->iv_myaddr);
 
 	/*
 	 * XXX should we error out if in_assoc is 1 and ni == NULL?
Index: head/sys/dev/iwm/if_iwm_scan.c
===================================================================
--- head/sys/dev/iwm/if_iwm_scan.c
+++ head/sys/dev/iwm/if_iwm_scan.c
@@ -371,6 +371,8 @@
 		.dataflags = { IWM_HCMD_DFL_NOCOPY, },
 	};
 	struct iwm_scan_cmd *cmd = sc->sc_scan_cmd;
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
 	int is_assoc = 0;
 	int ret;
 	uint32_t status;
@@ -421,8 +423,9 @@
 
 	cmd->tx_cmd.len = htole16(iwm_mvm_fill_probe_req(sc,
 			    (struct ieee80211_frame *)cmd->data,
-			    sc->sc_ic.ic_macaddr, n_ssids, ssid, ssid_len,
-			    NULL, 0, sc->sc_capa_max_probe_len));
+			    vap ? vap->iv_myaddr : ic->ic_macaddr, n_ssids,
+			    ssid, ssid_len, NULL, 0,
+			    sc->sc_capa_max_probe_len));
 
 	cmd->channel_count
 	    = iwm_mvm_scan_fill_channels(sc, cmd, flags, n_ssids, basic_ssid);