diff --git a/sys/net80211/ieee80211_scan.c b/sys/net80211/ieee80211_scan.c
index b41ed59a2131..951e7623aea4 100644
--- a/sys/net80211/ieee80211_scan.c
+++ b/sys/net80211/ieee80211_scan.c
@@ -131,6 +131,7 @@ ieee80211_scan_detach(struct ieee80211com *ic)
 		scan_signal(ss);
 		IEEE80211_UNLOCK(ic);
 		ieee80211_draintask(ic, &SCAN_PRIVATE(ss)->ss_scan_task);
+		callout_drain(&SCAN_PRIVATE(ss)->ss_scan_timer);
 		KASSERT((ic->ic_flags & IEEE80211_F_SCAN) == 0,
 		    ("scan still running"));
 		if (ss->ss_ops != NULL) {