diff --git a/sys/dev/usb/wlan/if_rum.c b/sys/dev/usb/wlan/if_rum.c
index 9b903f0dcf0d..149eaa4546bb 100644
--- a/sys/dev/usb/wlan/if_rum.c
+++ b/sys/dev/usb/wlan/if_rum.c
@@ -1167,10 +1167,6 @@ rum_tx_raw(struct rum_softc *sc, struct mbuf *m0, struct ieee80211_node *ni,
 	RUM_LOCK_ASSERT(sc, MA_OWNED);
 	KASSERT(params != NULL, ("no raw xmit params"));
 
-	data = STAILQ_FIRST(&sc->tx_free);
-	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
-	sc->tx_nfree--;
-
 	rate = params->ibp_rate0 & IEEE80211_RATE_VAL;
 	/* XXX validate */
 	if (rate == 0) {
@@ -1185,13 +1181,17 @@ rum_tx_raw(struct rum_softc *sc, struct mbuf *m0, struct ieee80211_node *ni,
 		    params->ibp_flags & IEEE80211_BPF_RTS ?
 			 IEEE80211_PROT_RTSCTS : IEEE80211_PROT_CTSONLY,
 		    rate);
-		if (error) {
+		if (error || sc->tx_nfree == 0) {
 			m_freem(m0);
-			return error;
+			return ENOBUFS;
 		}
 		flags |= RT2573_TX_LONG_RETRY | RT2573_TX_IFS_SIFS;
 	}
 
+	data = STAILQ_FIRST(&sc->tx_free);
+	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
+	sc->tx_nfree--;
+
 	data->m = m0;
 	data->ni = ni;
 	data->rate = rate;
@@ -1254,9 +1254,9 @@ rum_tx_data(struct rum_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
 			prot = ic->ic_protmode;
 		if (prot != IEEE80211_PROT_NONE) {
 			error = rum_sendprot(sc, m0, ni, prot, rate);
-			if (error) {
+			if (error || sc->tx_nfree == 0) {
 				m_freem(m0);
-				return error;
+				return ENOBUFS;
 			}
 			flags |= RT2573_TX_LONG_RETRY | RT2573_TX_IFS_SIFS;
 		}
@@ -1306,7 +1306,7 @@ rum_start(struct ifnet *ifp)
 		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
 		if (m == NULL)
 			break;
-		if (sc->tx_nfree == 0) {
+		if (sc->tx_nfree < RUM_TX_MINFREE) {
 			IFQ_DRV_PREPEND(&ifp->if_snd, m);
 			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
 			break;
@@ -2149,7 +2149,7 @@ rum_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 		ieee80211_free_node(ni);
 		return ENETDOWN;
 	}
-	if (sc->tx_nfree == 0) {
+	if (sc->tx_nfree < RUM_TX_MINFREE) {
 		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
 		RUM_UNLOCK(sc);
 		m_freem(m);
diff --git a/sys/dev/usb/wlan/if_rumvar.h b/sys/dev/usb/wlan/if_rumvar.h
index 1b58dc47b54f..fc66510e00ea 100644
--- a/sys/dev/usb/wlan/if_rumvar.h
+++ b/sys/dev/usb/wlan/if_rumvar.h
@@ -18,6 +18,7 @@
  */
 
 #define RUM_TX_LIST_COUNT	8
+#define RUM_TX_MINFREE		2
 
 struct rum_rx_radiotap_header {
 	struct ieee80211_radiotap_header wr_ihdr;
diff --git a/sys/dev/usb/wlan/if_ural.c b/sys/dev/usb/wlan/if_ural.c
index aebffaa46c36..49ccf85e0acd 100644
--- a/sys/dev/usb/wlan/if_ural.c
+++ b/sys/dev/usb/wlan/if_ural.c
@@ -1243,10 +1243,6 @@ ural_tx_raw(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni,
 	RAL_LOCK_ASSERT(sc, MA_OWNED);
 	KASSERT(params != NULL, ("no raw xmit params"));
 
-	data = STAILQ_FIRST(&sc->tx_free);
-	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
-	sc->tx_nfree--;
-
 	rate = params->ibp_rate0 & IEEE80211_RATE_VAL;
 	/* XXX validate */
 	if (rate == 0) {
@@ -1261,13 +1257,17 @@ ural_tx_raw(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni,
 		    params->ibp_flags & IEEE80211_BPF_RTS ?
 			 IEEE80211_PROT_RTSCTS : IEEE80211_PROT_CTSONLY,
 		    rate);
-		if (error) {
+		if (error || sc->tx_nfree == 0) {
 			m_freem(m0);
-			return error;
+			return ENOBUFS;
 		}
 		flags |= RAL_TX_IFS_SIFS;
 	}
 
+	data = STAILQ_FIRST(&sc->tx_free);
+	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
+	sc->tx_nfree--;
+
 	data->m = m0;
 	data->ni = ni;
 	data->rate = rate;
@@ -1328,9 +1328,9 @@ ural_tx_data(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
 			prot = ic->ic_protmode;
 		if (prot != IEEE80211_PROT_NONE) {
 			error = ural_sendprot(sc, m0, ni, prot, rate);
-			if (error) {
+			if (error || sc->tx_nfree == 0) {
 				m_freem(m0);
-				return error;
+				return ENOBUFS;
 			}
 			flags |= RAL_TX_IFS_SIFS;
 		}
@@ -1380,7 +1380,7 @@ ural_start(struct ifnet *ifp)
 		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
 		if (m == NULL)
 			break;
-		if (sc->tx_nfree == 0) {
+		if (sc->tx_nfree < RAL_TX_MINFREE) {
 			IFQ_DRV_PREPEND(&ifp->if_snd, m);
 			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
 			break;
@@ -2235,7 +2235,7 @@ ural_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 		ieee80211_free_node(ni);
 		return ENETDOWN;
 	}
-	if (sc->tx_nfree == 0) {
+	if (sc->tx_nfree < RAL_TX_MINFREE) {
 		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
 		RAL_UNLOCK(sc);
 		m_freem(m);
diff --git a/sys/dev/usb/wlan/if_uralvar.h b/sys/dev/usb/wlan/if_uralvar.h
index c7e546951e87..b9d378326f02 100644
--- a/sys/dev/usb/wlan/if_uralvar.h
+++ b/sys/dev/usb/wlan/if_uralvar.h
@@ -18,6 +18,7 @@
  */
 
 #define RAL_TX_LIST_COUNT	8
+#define RAL_TX_MINFREE		2
 
 #define URAL_SCAN_START         1
 #define URAL_SCAN_END           2