diff --git a/sys/dev/raid/mfi/mfi_tbolt.c b/sys/dev/raid/mfi/mfi_tbolt.c
--- a/sys/dev/raid/mfi/mfi_tbolt.c
+++ b/sys/dev/raid/mfi/mfi_tbolt.c
@@ -662,8 +662,15 @@ mfi_process_reply_desc(struct mfi_softc *sc,
 	while ((val.u.low != 0xFFFFFFFF) && (val.u.high != 0xFFFFFFFF)) {
 
 		smid = reply_desc->SMID;
-		if (!smid || smid > sc->mfi_max_fw_cmds + 1) {
+		/*
+		 * DF-1581: mfi_cmd_pool_tbolt[] is sized mfi_max_fw_cmds
+		 * (indices 0..mfi_max_fw_cmds-1); SMID range [1..N]
+		 * maps to indices [0..N-1].  The old off-by-one let
+		 * SMID == mfi_max_fw_cmds+1 read one pointer past the
+		 * array.  Tighten the upper bound and reject the +1 case.
+		 */
+		if (!smid || smid > sc->mfi_max_fw_cmds) {
 			device_printf(sc->mfi_dev, "smid is %x. Cannot "
 			    "proceed. Returning \n", smid);
 			return;