diff --git a/sys/dev/sound/pci/envy24ht.c b/sys/dev/sound/pci/envy24ht.c
--- a/sys/dev/sound/pci/envy24ht.c
+++ b/sys/dev/sound/pci/envy24ht.c
@@ -1953,7 +1953,18 @@
 envy24htmixer_setrecsrc(struct snd_mixer *m, u_int32_t src)
 {
 	struct sc_info *sc = mix_getdevinfo(m);
-	int ch = envy24ht_mixmap[src];
+	int ch;
+
+	/*
+	 * src is a bitmask (ENVY24HT_MIX_REC_MASK = 0x3e0) but envy24ht_mixmap
+	 * is indexed by bit position, not by raw bitmask value.  Convert with
+	 * ffs() and reject multi-bit / out-of-range inputs to avoid OOB reads
+	 * past the 25-entry mixmap.
+	 */
+	if (src == 0 || (src & (src - 1)) != 0 ||
+	    ffs(src) > (int)NELEM(envy24ht_mixmap))
+		return (src);
+	ch = envy24ht_mixmap[ffs(src) - 1];
 #if(0)
 	device_printf(sc->dev, "envy24htmixer_setrecsrc(m, %d)\n", src);
 #endif