diff --git a/sys/bus/firewire/fwdma.c b/sys/bus/firewire/fwdma.c
--- a/sys/bus/firewire/fwdma.c
+++ b/sys/bus/firewire/fwdma.c
@@ -150,6 +150,16 @@
 	bus_size_t ssize;
 	int nseg;
 
+	/*
+	 * Reject degenerate requests: esize == 0 triggers an integer
+	 * divide-by-zero in rounddown(PAGE_SIZE, esize) below (kernel
+	 * #DE trap -> panic), and n == 0 produces a useless zero-length
+	 * allocation. esize/n are caller-supplied via fwdev_allocbuf()
+	 * from the unchecked FW_SSTBUF ioctl path.
+	 */
+	if (esize <= 0 || n <= 0)
+		return (NULL);
+
 	if (esize > PAGE_SIZE) {
 		/* round up to PAGE_SIZE */
 		esize = ssize = roundup2(esize, PAGE_SIZE);
diff --git a/sys/bus/firewire/fwdev.c b/sys/bus/firewire/fwdev.c
--- a/sys/bus/firewire/fwdev.c
+++ b/sys/bus/firewire/fwdev.c
@@ -105,6 +105,8 @@
 		M_FW, M_WAITOK);
 
 	b->psize = roundup2(b->psize, sizeof(u_int32_t));
+	if (b->psize == 0 || b->nchunk == 0 || b->npacket == 0)
+		return (EINVAL);
 	q->buf = fwdma_malloc_multiseg(fc, sizeof(u_int32_t),
 			b->psize, b->nchunk * b->npacket, BUS_DMA_WAITOK);