diff --git a/sys/kern/subr_cpu_topology.c b/sys/kern/subr_cpu_topology.c
--- a/sys/kern/subr_cpu_topology.c
+++ b/sys/kern/subr_cpu_topology.c
@@ -137,6 +137,18 @@
 		root_cpu_node = node;
 
 	for (i = 0; i < node->child_no; i++) {
+		/*
+		 * Bound the cursor against cpu_topology_nodes[MAXCPU].
+		 * Without this the cursor overflows the fixed array on
+		 * high-CPU-count topologies (>=170 logical CPUs), corrupting
+		 * kernel BSS. Truncate the topology gracefully instead.
+		 */
+		if (*last_free_node >= &cpu_topology_nodes[MAXCPU]) {
+			kprintf("cpu_topology: node table overflow at level %d; "
+				"truncating topology\n", cur_level);
+			node->child_no = i;
+			return;
+		}
 		node->child_node[i] = *last_free_node;
 		(*last_free_node)++;