diff --git a/sys/bus/u4b/input/wsp.c b/sys/bus/u4b/input/wsp.c
--- a/sys/bus/u4b/input/wsp.c
+++ b/sys/bus/u4b/input/wsp.c
@@ -884,12 +884,22 @@
 		if (params->tp_type >= TYPE2) {
 			ibt = sc->tp_data[params->tp_button];
 			ntouch = sc->tp_data[params->tp_button - 1];
+		} else {
+			/* TYPE1: ntouch is derived from the payload length. */
+			ntouch = (len - params->tp_offset) / params->tp_fsize;
 		}
 		/* range check */
 		if (ntouch < 0)
 			ntouch = 0;
 		else if (ntouch > MAX_FINGERS)
 			ntouch = MAX_FINGERS;
+		/*
+		 * Without at least one finger index, the sc->index[0]
+		 * dereference below would fault on a freshly-M_ZERO'd
+		 * softc. Skip the post-processing entirely.
+		 */
+		if (ntouch == 0)
+			goto tr_setup;
 
 		for (i = 0; i != ntouch; i++) {
 			f = (struct tp_finger *)(sc->tp_data + params->tp_offset + params->tp_delta + i * params->tp_fsize);