diff --git a/sys/dev/acpica/acpi_cpu_cstate.c b/sys/dev/acpica/acpi_cpu_cstate.c
--- a/sys/dev/acpica/acpi_cpu_cstate.c
+++ b/sys/dev/acpica/acpi_cpu_cstate.c
@@ -681,6 +681,16 @@
      */
     acpi_cst_non_c3(sc);
 
+    /*
+     * DF-1554: if every sub-package was invalid, cst_cx_count stays 0
+     * and downstream code (acpi_cst_set_lowest_oncpu,
+     * acpi_cst_set_highest) computes cst_cx_count - 1 = -1 -> OOB
+     * read/write on cst_cx_states[-1] and the value -1 is stored in
+     * cst_cx_lowest, poisoning later calls.  Bail out with ENXIO.
+     */
+    if (sc->cst_cx_count == 0)
+	    return (ENXIO);
+
     cpu_sfence();
     sc->cst_flags &= ~ACPI_CST_FLAG_PROBING;