diff --git a/sys/dev/disk/ahci/ahci.c b/sys/dev/disk/ahci/ahci.c
--- a/sys/dev/disk/ahci/ahci.c
+++ b/sys/dev/disk/ahci/ahci.c
@@ -3487,6 +3487,12 @@
 		/* Copy back the log record as a D2H register FIS. */
 		err_slot = log->err_regs.type & ATA_LOG_10H_TYPE_TAG_MASK;
 
+		if (err_slot < 0 || err_slot >= ap->ap_sc->sc_ncmds) {
+			kprintf("%s: NCQ error log bad tag %d\n",
+				PORTNAME(ap), err_slot);
+			err_slot = -1;
+			goto err;
+		}
 		ccb2 = &ap->ap_ccbs[err_slot];
 		if (ccb2->ccb_xa.state == ATA_S_ONCHIP) {
 			kprintf("%s: read NCQ error page slot=%d\n",