diff --git a/sys/dev/disk/mpt/mpt.c b/sys/dev/disk/mpt/mpt.c
--- a/sys/dev/disk/mpt/mpt.c
+++ b/sys/dev/disk/mpt/mpt.c
@@ -2653,6 +2653,19 @@
 	}
 	mpt2host_iocfacts_reply(&mpt->ioc_facts);
 
+	/*
+	 * Reject a malformed IOCFACTS reply that reports a zero
+	 * RequestFrameSize; otherwise the MPT_RQSL(mpt) and
+	 * MPT_NRFM(mpt) macros below divide by zero (MPT_REQUEST_AREA
+	 * / (RequestFrameSize << 2)) and crash the system.  A real
+	 * IOC always reports a non-zero frame size, so this guard
+	 * only ever fires on a broken or malicious device.
+	 */
+	if (mpt->ioc_facts.RequestFrameSize == 0) {
+		mpt_prt(mpt, "IOCFACTS reports RequestFrameSize of 0\n");
+		return (EINVAL);
+	}
+
 	mpt_prt(mpt, "MPI Version=%d.%d.%d.%d\n",
 	    mpt->ioc_facts.MsgVersion >> 8,
 	    mpt->ioc_facts.MsgVersion & 0xFF,