diff --git a/sys/dev/raid/hptmv/gui_lib.c b/sys/dev/raid/hptmv/gui_lib.c
--- a/sys/dev/raid/hptmv/gui_lib.c
+++ b/sys/dev/raid/hptmv/gui_lib.c
@@ -570,7 +570,15 @@
 
 	if (pParam->nDisk > MAX_MEMBERS)
 		return INVALID_DEVICEID;
-/* check in verify_vd
+	/*
+	 * DF-1529: the original per-member validation was commented out
+	 * ("check in verify_vd"), allowing Members[1..nDisk-1] to be
+	 * arbitrary attacker-chosen IDs that get dereferenced via
+	 * ID_TO_VDEV() at lines 646, 682, 742.  Restore the check here so
+	 * every Members[i] resolves to a valid, online, non-array PVDevice
+	 * on the same VBus before we allocate the array and start writing
+	 * to the pointed-to fields.
+	 */
 	for(i = 0; i < pParam->nDisk; i++)
 	{
 		PVDevice pVDev = ID_TO_VDEV(pParam->Members[i]);
@@ -582,8 +590,6 @@
 		else if (_vbus_p != pVDev->u.disk.pVBus)
 			return INVALID_DEVICEID;
 	}
-*/
-	_vbus_p = (ID_TO_VDEV(pParam->Members[0]))->u.disk.pVBus;
 	if (!_vbus_p) return INVALID_DEVICEID;
 
 	mArGetArrayTable(pArray);