--- a/net80211/ieee80211_node.c
+++ b/net80211/ieee80211_node.c
@@ -647,8 +647,11 @@ ieee80211_sta_join1(struct ieee80211_nod
 		(vap->iv_state == IEEE80211_S_RUN) && bssid_equal(obss, selbs)); */
 	vap->iv_bss = selbs;
 	IEEE80211_ADDR_COPY(vap->iv_bssid, selbs->ni_bssid);
-	if (obss != NULL)
+	if (obss != NULL) {
+		if (obss->ni_table)
+			ieee80211_node_leave(obss);
 		ieee80211_unref_node(&obss);
+	}
 	ic->ic_bsschan = selbs->ni_chan;
 	ic->ic_curchan = ic->ic_bsschan;
 	ic->ic_curmode = ieee80211_chan2mode(ic->ic_curchan);
--- a/net80211/ieee80211_proto.c
+++ b/net80211/ieee80211_proto.c
@@ -1602,7 +1602,6 @@ __ieee80211_newstate(struct ieee80211vap
 				IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0);
 			break;
 		case IEEE80211_S_RUN:
-			ieee80211_node_leave(ni);
 			if (ic->ic_roaming == IEEE80211_ROAMING_AUTO) {
 				/* NB: caller specifies ASSOC/REASSOC by arg */
 				IEEE80211_SEND_MGMT(ni, arg ?