diff --git a/sys/vfs/ext2fs/ext2_csum.c b/sys/vfs/ext2fs/ext2_csum.c
--- a/sys/vfs/ext2fs/ext2_csum.c
+++ b/sys/vfs/ext2fs/ext2_csum.c
@@ -282,6 +282,8 @@
 	if (count_offset + (limit * sizeof(struct ext2fs_htree_entry)) >
 	    ip->i_e2fs->e2fs_bsize - sizeof(struct ext2fs_htree_tail))
 		return (EIO);
+	if (count > limit)
+		return (EIO);
 
 	tp = (struct ext2fs_htree_tail *)(((struct ext2fs_htree_entry *)cp) + limit);
 	calculated = ext2_dx_csum(ip, ep,  count_offset, count, tp);
@@ -358,6 +360,8 @@
 	if (count_offset + (limit * sizeof(struct ext2fs_htree_entry)) >
 	    ip->i_e2fs->e2fs_bsize - sizeof(struct ext2fs_htree_tail))
 		return;
+	if (count > limit)
+		return;
 
 	tp = (struct ext2fs_htree_tail *)(((struct ext2fs_htree_entry *)cp) + limit);
 	tp->ht_checksum = ext2_dx_csum(ip, ep,  count_offset, count, tp);