diff --git a/sys/netproto/smb/smb_usr.c b/sys/netproto/smb/smb_usr.c
--- a/sys/netproto/smb/smb_usr.c
+++ b/sys/netproto/smb/smb_usr.c
@@ -296,7 +296,7 @@
 	struct mdchain *mdp;
 	int error, len;
 
-	if (dp->ioc_setupcnt > 3)
+	if (dp->ioc_setupcnt < 0 || dp->ioc_setupcnt > 3)
 		return EINVAL;
 	error = smb_t2_init(t2p, SSTOCP(ssp), dp->ioc_setup[0], scred);
 	if (error)