diff --git a/src/add-ons/kernel/drivers/network/wlan/iaxwifi200/dev/pci/if_iwx.c b/src/add-ons/kernel/drivers/network/wlan/iaxwifi200/dev/pci/if_iwx.c
index ee7fa0378c..00e19e1f2c 100644
--- a/src/add-ons/kernel/drivers/network/wlan/iaxwifi200/dev/pci/if_iwx.c
+++ b/src/add-ons/kernel/drivers/network/wlan/iaxwifi200/dev/pci/if_iwx.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_iwx.c,v 1.150 2022/08/29 17:59:12 stsp Exp $	*/
+/*	$OpenBSD: if_iwx.c,v 1.153 2023/02/19 12:23:27 stsp Exp $	*/
 
 /*
  * Copyright (c) 2014, 2016 genua gmbh <info@genua.de>
@@ -320,6 +320,7 @@ int	iwx_disable_txq(struct iwx_softc *sc, int, int, uint8_t);
 void	iwx_post_alive(struct iwx_softc *);
 int	iwx_schedule_session_protection(struct iwx_softc *, struct iwx_node *,
 	    uint32_t);
+void	iwx_unprotect_session(struct iwx_softc *, struct iwx_node *);
 void	iwx_init_channel_map(struct iwx_softc *, uint16_t *, uint32_t *, int);
 void	iwx_setup_ht_rates(struct iwx_softc *);
 void	iwx_setup_vht_rates(struct iwx_softc *);
@@ -2919,55 +2920,6 @@ iwx_post_alive(struct iwx_softc *sc)
 	iwx_ict_reset(sc);
 }
 
-/*
- * For the high priority TE use a time event type that has similar priority to
- * the FW's action scan priority.
- */
-#define IWX_ROC_TE_TYPE_NORMAL IWX_TE_P2P_DEVICE_DISCOVERABLE
-#define IWX_ROC_TE_TYPE_MGMT_TX IWX_TE_P2P_CLIENT_ASSOC
-
-int
-iwx_send_time_event_cmd(struct iwx_softc *sc,
-    const struct iwx_time_event_cmd *cmd)
-{
-	struct iwx_rx_packet *pkt;
-	struct iwx_time_event_resp *resp;
-	struct iwx_host_cmd hcmd = {
-		.id = IWX_TIME_EVENT_CMD,
-		.flags = IWX_CMD_WANT_RESP,
-		.resp_pkt_len = sizeof(*pkt) + sizeof(*resp),
-	};
-	uint32_t resp_len;
-	int err;
-
-	hcmd.data[0] = cmd;
-	hcmd.len[0] = sizeof(*cmd);
-	err = iwx_send_cmd(sc, &hcmd);
-	if (err)
-		return err;
-
-	pkt = hcmd.resp_pkt;
-	if (!pkt || (pkt->hdr.flags & IWX_CMD_FAILED_MSK)) {
-		err = EIO;
-		goto out;
-	}
-
-	resp_len = iwx_rx_packet_payload_len(pkt);
-	if (resp_len != sizeof(*resp)) {
-		err = EIO;
-		goto out;
-	}
-
-	resp = (void *)pkt->data;
-	if (le32toh(resp->status) == 0)
-		sc->sc_time_event_uid = le32toh(resp->unique_id);
-	else
-		err = EIO;
-out:
-	iwx_free_resp(sc, &hcmd);
-	return err;
-}
-
 int
 iwx_schedule_session_protection(struct iwx_softc *sc, struct iwx_node *in,
     uint32_t duration)
@@ -2980,9 +2932,34 @@ iwx_schedule_session_protection(struct iwx_softc *sc, struct iwx_node *in,
 		.duration_tu = htole32(duration * IEEE80211_DUR_TU),
 	};
 	uint32_t cmd_id;
+	int err;
 
 	cmd_id = iwx_cmd_id(IWX_SESSION_PROTECTION_CMD, IWX_MAC_CONF_GROUP, 0);
-	return iwx_send_cmd_pdu(sc, cmd_id, 0, sizeof(cmd), &cmd);
+	err = iwx_send_cmd_pdu(sc, cmd_id, 0, sizeof(cmd), &cmd);
+	if (!err)
+		sc->sc_flags |= IWX_FLAG_TE_ACTIVE;
+	return err;
+}
+
+void
+iwx_unprotect_session(struct iwx_softc *sc, struct iwx_node *in)
+{
+	struct iwx_session_prot_cmd cmd = {
+		.id_and_color = htole32(IWX_FW_CMD_ID_AND_COLOR(in->in_id,
+		    in->in_color)),
+		.action = htole32(IWX_FW_CTXT_ACTION_REMOVE),
+		.conf_id = htole32(IWX_SESSION_PROTECT_CONF_ASSOC),
+		.duration_tu = 0,
+	};
+	uint32_t cmd_id;
+
+	/* Do nothing if the time event has already ended. */
+	if ((sc->sc_flags & IWX_FLAG_TE_ACTIVE) == 0)
+		return;
+
+	cmd_id = iwx_cmd_id(IWX_SESSION_PROTECTION_CMD, IWX_MAC_CONF_GROUP, 0);
+	if (iwx_send_cmd_pdu(sc, cmd_id, 0, sizeof(cmd), &cmd) == 0)
+		sc->sc_flags &= ~IWX_FLAG_TE_ACTIVE;
 }
 
 /*
@@ -3443,6 +3420,8 @@ iwx_mac_ctxt_task(void *arg)
 	if (err)
 		printf("%s: failed to update MAC\n", DEVNAME(sc));
 
+	iwx_unprotect_session(sc, in);
+
 	refcnt_rele_wake(&sc->task_refs);
 	splx(s);
 }
@@ -7858,6 +7837,8 @@ iwx_deauth(struct iwx_softc *sc)
 
 	splassert(IPL_NET);
 
+	iwx_unprotect_session(sc, in);
+
 	if (sc->sc_flags & IWX_FLAG_STA_ACTIVE) {
 		err = iwx_rm_sta(sc, in);
 		if (err)
@@ -8101,7 +8082,7 @@ iwx_set_key(struct ieee80211com *ic, struct ieee80211_node *ni,
 	if (k->k_cipher != IEEE80211_CIPHER_CCMP) {
 		/* Fallback to software crypto for other ciphers. */
 		err = ieee80211_set_key(ic, ni, k);
-		if (!err && (k->k_flags & IEEE80211_KEY_GROUP))
+		if (!err && in != NULL && (k->k_flags & IEEE80211_KEY_GROUP))
 			in->in_flags |= IWX_NODE_FLAG_HAVE_GROUP_KEY;
 		return err;
 	}
@@ -9688,8 +9669,21 @@ iwx_rx_pkt(struct iwx_softc *sc, struct iwx_rx_data *data, struct mbuf_list *ml)
 		}
 
 		case IWX_WIDE_ID(IWX_MAC_CONF_GROUP,
-		    IWX_SESSION_PROTECTION_NOTIF):
+		    IWX_SESSION_PROTECTION_NOTIF): {
+			struct iwx_session_prot_notif *notif;
+			uint32_t status, start, conf_id;
+
+			SYNC_RESP_STRUCT(notif, pkt);
+
+			status = le32toh(notif->status);
+			start = le32toh(notif->start);
+			conf_id = le32toh(notif->conf_id);
+			/* Check for end of successful PROTECT_CONF_ASSOC. */
+			if (status == 1 && start == 0 &&
+			    conf_id == IWX_SESSION_PROTECT_CONF_ASSOC)
+				sc->sc_flags &= ~IWX_FLAG_TE_ACTIVE;
 			break;
+		}
 
 		case IWX_WIDE_ID(IWX_SYSTEM_GROUP,
 		    IWX_FSEQ_VER_MISMATCH_NOTIFICATION):
@@ -11110,13 +11104,20 @@ iwx_wakeup(struct iwx_softc *sc)
 	struct ifnet *ifp = &sc->sc_ic.ic_if;
 	int err;
 
+	rw_enter_write(&sc->ioctl_rwl);
+
 	err = iwx_start_hw(sc);
-	if (err)
+	if (err) {
+		rw_exit(&sc->ioctl_rwl);
 		return err;
+	}
 
 	err = iwx_init_hw(sc);
-	if (err)
+	if (err) {
+		iwx_stop_device(sc);
+		rw_exit(&sc->ioctl_rwl);
 		return err;
+	}
 
 	refcnt_init(&sc->task_refs);
 	ifq_clr_oactive(&ifp->if_snd);
@@ -11127,6 +11128,7 @@ iwx_wakeup(struct iwx_softc *sc)
 	else
 		ieee80211_begin_scan(ifp);
 
+	rw_exit(&sc->ioctl_rwl);
 	return 0;
 }
 
diff --git a/src/add-ons/kernel/drivers/network/wlan/iaxwifi200/dev/pci/if_iwxreg.h b/src/add-ons/kernel/drivers/network/wlan/iaxwifi200/dev/pci/if_iwxreg.h
index 732c6f18f6..3b9cbde8fc 100644
--- a/src/add-ons/kernel/drivers/network/wlan/iaxwifi200/dev/pci/if_iwxreg.h
+++ b/src/add-ons/kernel/drivers/network/wlan/iaxwifi200/dev/pci/if_iwxreg.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_iwxreg.h,v 1.39 2022/05/10 09:11:44 stsp Exp $	*/
+/*	$OpenBSD: if_iwxreg.h,v 1.41 2023/02/14 12:14:07 stsp Exp $	*/
 
 /*-
  * Based on BSD-licensed source modules in the Linux iwlwifi driver,
@@ -3628,7 +3628,10 @@ struct iwx_rx_mpdu_desc_v3 {
 		 * TSF value on air rise (INA), only valid if
 		 * IWX_RX_MPDU_PHY_TSF_OVERLOAD isn't set
 		 */
-		uint64_t tsf_on_air_rise;
+		struct {
+			uint32_t tsf_on_air_rise0;
+			uint32_t tsf_on_air_rise1;
+		};
 
 		struct {
 			uint32_t phy_data0;
@@ -3657,7 +3660,10 @@ struct iwx_rx_mpdu_desc_v1 {
 	uint8_t mac_context;
 	uint32_t gp2_on_air_rise;
 	union {
-		uint64_t tsf_on_air_rise;
+		struct {
+			uint32_t tsf_on_air_rise0;
+			uint32_t tsf_on_air_rise1;
+		};
 		struct {
 			uint32_t phy_data0;
 			uint32_t phy_data1;
diff --git a/src/add-ons/kernel/drivers/network/wlan/idualwifi7260/dev/pci/if_iwm.c b/src/add-ons/kernel/drivers/network/wlan/idualwifi7260/dev/pci/if_iwm.c
index f82f14e7d7..9ca346665e 100644
--- a/src/add-ons/kernel/drivers/network/wlan/idualwifi7260/dev/pci/if_iwm.c
+++ b/src/add-ons/kernel/drivers/network/wlan/idualwifi7260/dev/pci/if_iwm.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_iwm.c,v 1.404 2022/08/29 17:59:12 stsp Exp $	*/
+/*	$OpenBSD: if_iwm.c,v 1.405 2022/12/16 13:49:35 stsp Exp $	*/
 
 /*
  * Copyright (c) 2014, 2016 genua gmbh <info@genua.de>
@@ -10378,9 +10378,6 @@ iwm_init(struct ifnet *ifp)
 
 	generation = ++sc->sc_generation;
 
-	KASSERT(sc->task_refs.r_refs == 0);
-	refcnt_init(&sc->task_refs);
-
 	err = iwm_preinit(sc);
 	if (err)
 		return err;
@@ -10394,7 +10391,7 @@ iwm_init(struct ifnet *ifp)
 	err = iwm_init_hw(sc);
 	if (err) {
 		if (generation == sc->sc_generation)
-			iwm_stop(ifp);
+			iwm_stop_device(sc);
 		return err;
 	}
 
@@ -10403,6 +10400,8 @@ iwm_init(struct ifnet *ifp)
 	if (sc->sc_nvm.sku_cap_11ac_enable)
 		iwm_setup_vht_rates(sc);
 
+	KASSERT(sc->task_refs.r_refs == 0);
+	refcnt_init(&sc->task_refs);
 	ifq_clr_oactive(&ifp->if_snd);
 	ifp->if_flags |= IFF_RUNNING;