diff --git a/sys/dev/raid/mps/mps.c b/sys/dev/raid/mps/mps.c
--- a/sys/dev/raid/mps/mps.c
+++ b/sys/dev/raid/mps/mps.c
@@ -1512,6 +1512,14 @@
 
 		switch (flags) {
 		case MPI2_RPY_DESCRIPT_FLAGS_SCSI_IO_SUCCESS:
+			if (desc->SCSIIOSuccess.SMID == 0 ||
+			    desc->SCSIIOSuccess.SMID >= sc->num_reqs) {
+				device_printf(sc->mps_dev, "Invalid SMID %u in "
+				    "SCSI_IO_SUCCESS reply, ignoring\n",
+				    desc->SCSIIOSuccess.SMID);
+				cm = NULL;
+				break;
+			}
 			cm = &sc->commands[desc->SCSIIOSuccess.SMID];
 			cm->cm_reply = NULL;
 			break;
@@ -1578,6 +1586,14 @@
 					    (MPI2_EVENT_NOTIFICATION_REPLY *)
 					    reply);
 			} else {
+				if (desc->AddressReply.SMID == 0 ||
+				    desc->AddressReply.SMID >= sc->num_reqs) {
+					device_printf(sc->mps_dev, "Invalid SMID "
+					    "%u in ADDRESS_REPLY, ignoring\n",
+					    desc->AddressReply.SMID);
+					cm = NULL;
+					break;
+				}
 				cm = &sc->commands[desc->AddressReply.SMID];
 				cm->cm_reply = reply;
 				cm->cm_reply_data =