diff --git a/sys/dev/netif/ath/ath_hal/ah.c b/sys/dev/netif/ath/ath_hal/ah.c
--- a/sys/dev/netif/ath/ath_hal/ah.c
+++ b/sys/dev/netif/ath/ath_hal/ah.c
@@ -882,12 +882,23 @@
 	void **result, uint32_t *resultsize)
 {
 
+	/*
+	 * DF-1521: callers can omit ATH_DIAG_DYN / ATH_DIAG_IN, in which
+	 * case *result and/or args are NULL.  Refuse sinks that would
+	 * deref NULL.
+	 */
+	if (result == NULL || *result == NULL || resultsize == NULL)
+		return AH_FALSE;
+
 	switch (request) {
 	case HAL_DIAG_REVS:
 		*result = &AH_PRIVATE(ah)->ah_devid;
 		*resultsize = sizeof(HAL_REVS);
 		return AH_TRUE;
 	case HAL_DIAG_REGS:
+		/* DF-1520: require non-NULL args + argsize for the reg dump */
+		if (args == NULL || argsize == 0)
+			return AH_FALSE;
 		*resultsize = ath_hal_getregdump(ah, args, *result,*resultsize);
 		return AH_TRUE;
 	case HAL_DIAG_SETREGS:
@@ -899,6 +910,9 @@
 		*resultsize = sizeof(AH_PRIVATE(ah)->ah_fatalState);
 		return AH_TRUE;
 	case HAL_DIAG_EEREAD:
+		/* DF-1521: NULL guard same as above */
+		if (args == NULL || *result == NULL)
+			return AH_FALSE;
 		if (argsize != sizeof(uint16_t))
 			return AH_FALSE;
 		if (!ath_hal_eepromRead(ah, *(const uint16_t *)args, *result))