Multi- and single-user beamforming is a key feature for realizing a high data rate in next-generation Wi-Fi such as IEEE 802.11ax. In this paper, we study for the first time, a jammer that strategically attacks layer two (L2) control frames associated with beamforming to realize a denial-of-service (DoS) attack on transport (L4) and application layer (L7) control planes. By coupling the attack across control plane layers, the attacker targets throughput or availability DoS while also maintaining stealth via low airtime jamming and “off-target jamming” in which the targeted higher layer message is never directly jammed. With end-to-end application layer experiments, we show that such a jammer can reduce TCP throughput to 1% with less than 0.1% of jamming air-time. Moreover, the attack can yield seconds-to-minute scale outages by targeting the L4 or L7 setup messages while leaving a minimal footprint.