+++ /dev/null
---- a/net80211/ieee80211_node.c
-+++ b/net80211/ieee80211_node.c
-@@ -647,8 +647,11 @@ ieee80211_sta_join1(struct ieee80211_nod
- (vap->iv_state == IEEE80211_S_RUN) && bssid_equal(obss, selbs)); */
- vap->iv_bss = selbs;
- IEEE80211_ADDR_COPY(vap->iv_bssid, selbs->ni_bssid);
-- if (obss != NULL)
-+ if (obss != NULL) {
-+ if (obss->ni_table)
-+ ieee80211_node_leave(obss);
- ieee80211_unref_node(&obss);
-+ }
- ic->ic_bsschan = selbs->ni_chan;
- ic->ic_curchan = ic->ic_bsschan;
- ic->ic_curmode = ieee80211_chan2mode(ic->ic_curchan);
---- a/net80211/ieee80211_proto.c
-+++ b/net80211/ieee80211_proto.c
-@@ -1602,7 +1602,6 @@ __ieee80211_newstate(struct ieee80211vap
- IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0);
- break;
- case IEEE80211_S_RUN:
-- ieee80211_node_leave(ni);
- if (ic->ic_roaming == IEEE80211_ROAMING_AUTO) {
- /* NB: caller specifies ASSOC/REASSOC by arg */
- IEEE80211_SEND_MGMT(ni, arg ?