diff --git a/sys/net80211/ieee80211_crypto_ccmp.c b/sys/net80211/ieee80211_crypto_ccmp.c
index d0ccc9313474..2a372f1ee0b2 100644
--- a/sys/net80211/ieee80211_crypto_ccmp.c
+++ b/sys/net80211/ieee80211_crypto_ccmp.c
@@ -91,6 +91,9 @@ static	int ccmp_encrypt(struct ieee80211_key *, struct mbuf *, int hdrlen);
 static	int ccmp_decrypt(struct ieee80211_key *, u_int64_t pn,
 		struct mbuf *, int hdrlen);
 
+/* number of references from net80211 layer */
+static	int nrefs = 0;
+
 static void *
 ccmp_attach(struct ieee80211com *ic, struct ieee80211_key *k)
 {
@@ -103,6 +106,7 @@ ccmp_attach(struct ieee80211com *ic, struct ieee80211_key *k)
 		return NULL;
 	}
 	ctx->cc_ic = ic;
+	nrefs++;			/* NB: we assume caller locking */
 	return ctx;
 }
 
@@ -112,6 +116,8 @@ ccmp_detach(struct ieee80211_key *k)
 	struct ccmp_ctx *ctx = k->wk_private;
 
 	FREE(ctx, M_DEVBUF);
+	KASSERT(nrefs > 0, ("imbalanced attach/detach"));
+	nrefs--;			/* NB: we assume caller locking */
 }
 
 static int
@@ -637,7 +643,14 @@ ccmp_modevent(module_t mod, int type, void *unused)
 		ieee80211_crypto_register(&ccmp);
 		return 0;
 	case MOD_UNLOAD:
-		ieee80211_crypto_unregister(&ccmp);
+	case MOD_QUIESCE:
+		if (nrefs) {
+			printf("wlan_ccmp: still in use (%u dynamic refs)\n",
+				nrefs);
+			return EBUSY;
+		}
+		if (type == MOD_UNLOAD)
+			ieee80211_crypto_unregister(&ccmp);
 		return 0;
 	}
 	return EINVAL;
diff --git a/sys/net80211/ieee80211_crypto_tkip.c b/sys/net80211/ieee80211_crypto_tkip.c
index 6775ee7f4281..e3c5de91ead9 100644
--- a/sys/net80211/ieee80211_crypto_tkip.c
+++ b/sys/net80211/ieee80211_crypto_tkip.c
@@ -106,6 +106,9 @@ static	int tkip_encrypt(struct tkip_ctx *, struct ieee80211_key *,
 static	int tkip_decrypt(struct tkip_ctx *, struct ieee80211_key *,
 		struct mbuf *, int hdr_len);
 
+/* number of references from net80211 layer */
+static	int nrefs = 0;
+
 static void *
 tkip_attach(struct ieee80211com *ic, struct ieee80211_key *k)
 {
@@ -119,6 +122,7 @@ tkip_attach(struct ieee80211com *ic, struct ieee80211_key *k)
 	}
 
 	ctx->tc_ic = ic;
+	nrefs++;			/* NB: we assume caller locking */
 	return ctx;
 }
 
@@ -128,6 +132,8 @@ tkip_detach(struct ieee80211_key *k)
 	struct tkip_ctx *ctx = k->wk_private;
 
 	FREE(ctx, M_DEVBUF);
+	KASSERT(nrefs > 0, ("imbalanced attach/detach"));
+	nrefs--;			/* NB: we assume caller locking */
 }
 
 static int
@@ -978,7 +984,14 @@ tkip_modevent(module_t mod, int type, void *unused)
 		ieee80211_crypto_register(&tkip);
 		return 0;
 	case MOD_UNLOAD:
-		ieee80211_crypto_unregister(&tkip);
+	case MOD_QUIESCE:
+		if (nrefs) {
+			printf("wlan_tkip: still in use (%u dynamic refs)\n",
+				nrefs);
+			return EBUSY;
+		}
+		if (type == MOD_UNLOAD)
+			ieee80211_crypto_unregister(&tkip);
 		return 0;
 	}
 	return EINVAL;
diff --git a/sys/net80211/ieee80211_crypto_wep.c b/sys/net80211/ieee80211_crypto_wep.c
index 451324193e62..eb8ad8a9d403 100644
--- a/sys/net80211/ieee80211_crypto_wep.c
+++ b/sys/net80211/ieee80211_crypto_wep.c
@@ -82,6 +82,9 @@ struct wep_ctx {
 	u_int32_t	wc_iv;		/* initial vector for crypto */
 };
 
+/* number of references from net80211 layer */
+static	int nrefs = 0;
+
 static void *
 wep_attach(struct ieee80211com *ic, struct ieee80211_key *k)
 {
@@ -96,6 +99,7 @@ wep_attach(struct ieee80211com *ic, struct ieee80211_key *k)
 
 	ctx->wc_ic = ic;
 	get_random_bytes(&ctx->wc_iv, sizeof(ctx->wc_iv));
+	nrefs++;			/* NB: we assume caller locking */
 	return ctx;
 }
 
@@ -105,6 +109,8 @@ wep_detach(struct ieee80211_key *k)
 	struct wep_ctx *ctx = k->wk_private;
 
 	FREE(ctx, M_DEVBUF);
+	KASSERT(nrefs > 0, ("imbalanced attach/detach"));
+	nrefs--;			/* NB: we assume caller locking */
 }
 
 static int
@@ -481,7 +487,14 @@ wep_modevent(module_t mod, int type, void *unused)
 		ieee80211_crypto_register(&wep);
 		return 0;
 	case MOD_UNLOAD:
-		ieee80211_crypto_unregister(&wep);
+	case MOD_QUIESCE:
+		if (nrefs) {
+			printf("wlan_wep: still in use (%u dynamic refs)\n",
+				nrefs);
+			return EBUSY;
+		}
+		if (type == MOD_UNLOAD)
+			ieee80211_crypto_unregister(&wep);
 		return 0;
 	}
 	return EINVAL;