diff --git a/sys/dev/raid/mps/mps_mapping.c b/sys/dev/raid/mps/mps_mapping.c
--- a/sys/dev/raid/mps/mps_mapping.c
+++ b/sys/dev/raid/mps/mps_mapping.c
@@ -1522,6 +1522,18 @@
 				    MPI2_DRVMAP0_MAPINFO_SLOT_MASK;
 				num_slots >>= MPI2_DRVMAP0_MAPINFO_SLOT_SHIFT;
 			}
+			/*
+			 * Bounds-check the firmware-supplied DeviceIndex and slot count
+			 * against the mapping table size before indexing it (DF-1374).
+			 */
+			if (dev_idx >= sc->max_devices ||
+			    num_slots > sc->max_devices ||
+			    dev_idx + num_slots > sc->max_devices) {
+				kprintf("%s: DPM entry %d DeviceIndex %d/%d exceeds max "
+				    "devices %d, skipping.\n", __func__, entry_num,
+				    dev_idx, num_slots, sc->max_devices);
+				break;
+			}
 			enc_idx = sc->num_enc_table_entries;
 			if (enc_idx >= sc->max_enclosures) {
 				kprintf("%s: enclosure entries exceed max "
@@ -1564,6 +1576,12 @@
 		} else if ((ioc_pg8_flags &
 		    MPI2_IOCPAGE8_FLAGS_MASK_MAPPING_MODE) ==
 		    MPI2_IOCPAGE8_FLAGS_DEVICE_PERSISTENCE_MAPPING) {
+			if (dev_idx >= sc->max_devices) {
+				kprintf("%s: DPM entry %d DeviceIndex %d exceeds max devices "
+				    "%d, skipping.\n", __func__, entry_num, dev_idx,
+				    sc->max_devices);
+				break;
+			}
 			map_idx = dev_idx;
 			mt_entry = &sc->mapping_table[map_idx];
 			if (mt_entry->dpm_entry_num != MPS_DPM_BAD_IDX) {