diff --git a/sys/dev/disk/nata/ata-all.c b/sys/dev/disk/nata/ata-all.c
--- a/sys/dev/disk/nata/ata-all.c
+++ b/sys/dev/disk/nata/ata-all.c
@@ -459,6 +459,9 @@
 
     switch (cmd) {
     case IOCATAREQUEST:
+	if (ioc_request->count == 0 || ioc_request->count > MAXPHYS) {
+	    return EINVAL;
+	}
 	if (!(buf = kmalloc(ioc_request->count, M_ATA, M_WAITOK | M_NULLOK))) {
 	    return ENOMEM;
 	}