diff --git a/sys/dev/raid/hptmv/gui_lib.c b/sys/dev/raid/hptmv/gui_lib.c
--- a/sys/dev/raid/hptmv/gui_lib.c
+++ b/sys/dev/raid/hptmv/gui_lib.c
@@ -1169,8 +1169,16 @@
 			if (nInBufferSize!=8) return -1;
 			if (nOutBufferSize!=sizeof(CHANNEL_INFO)) return -1;
 
+			/*
+			 * DF-1530: bus comes straight from a user DWORD and indexes
+			 * mvChannel[bus] / VDevices[bus] which are MV_SATA_CHANNELS_NUM
+			 * entries wide.  Reject negative or out-of-range values to
+			 * avoid OOB / wild-pointer derefs in hpt_get_channel_info().
+			 */
 			id = *(DWORD *)lpInBuffer;
 			bus = ((DWORD *)lpInBuffer)[1];
+			if ((unsigned int)bus >= MV_SATA_CHANNELS_NUM)
+				return -1;
 			pInfo = (PCHANNEL_INFO)lpOutBuffer;
 
 			if (hpt_get_channel_info(id, bus, pInfo)!=0)