The initial ram disk mounts the encrypted root on /altroot and then chroots into it. The kernel however needs to be instructed to look for firmware in the real path, which means prepending/altroot to the standard firmware path(s).
Add this line to /etc/sysctl.conf:
hw.firmware.path=/altroot/libdata/firmware:/altroot/usr/libdata/firmware:/altroot/usr/pkg/libdata/firmware
