diff --git a/sys/dev/raid/mrsas/mrsas_fp.c b/sys/dev/raid/mrsas/mrsas_fp.c
--- a/sys/dev/raid/mrsas/mrsas_fp.c
+++ b/sys/dev/raid/mrsas/mrsas_fp.c
@@ -253,6 +253,19 @@
     MR_FW_RAID_MAP_ALL *map = sc->raidmap_mem[(sc->map_id & 1)];
     MR_FW_RAID_MAP *pFwRaidMap = &map->raidMap;
     PLD_SPAN_INFO ldSpanInfo = (PLD_SPAN_INFO) &sc->log_to_span;
+
+    /*
+     * DF-1528: MR_ValidateMapInfo only verifies that totalSize matches
+     * the size implied by ldCount.  Downstream accessors index
+     * fixed-size arrays (spanBlock[MAX_RAIDMAP_SPAN_DEPTH], quad[],
+     * dataArmMap[], arMapInfo[].pd[]) using firmware-controlled
+     * per-LD/per-span/per-row fields.  Reject obviously bogus top-level
+     * counts before use.
+     */
+    if (pFwRaidMap->ldCount > MAX_LOGICAL_DRIVES ||
+        pFwRaidMap->ldCount == 0) {
+        return 1;
+    }
 
     total_map_sz = (sizeof(MR_FW_RAID_MAP) - sizeof(MR_LD_SPAN_MAP) +
                      (sizeof(MR_LD_SPAN_MAP) * pFwRaidMap->ldCount));