diff --git a/sys/dev/raid/vinum/vinumstate.c b/sys/dev/raid/vinum/vinumstate.c
--- a/sys/dev/raid/vinum/vinumstate.c
+++ b/sys/dev/raid/vinum/vinumstate.c
@@ -857,6 +857,36 @@
     else
 	flags = setstate_none;				    /* no */
 
+    /* Validate the object index against the allocated arrays. */
+    switch (data->type) {
+    case drive_object:
+	if (objindex < 0 || objindex >= vinum_conf.drives_allocated) {
+	    ioctl_reply->error = EINVAL;
+	    return;
+	}
+	break;
+    case sd_object:
+	if (objindex < 0 || objindex >= vinum_conf.sds_allocated) {
+	    ioctl_reply->error = EINVAL;
+	    return;
+	}
+	break;
+    case plex_object:
+	if (objindex < 0 || objindex >= vinum_conf.plexes_allocated) {
+	    ioctl_reply->error = EINVAL;
+	    return;
+	}
+	break;
+    case volume_object:
+	if (objindex < 0 || objindex >= vinum_conf.volumes_allocated) {
+	    ioctl_reply->error = EINVAL;
+	    return;
+	}
+	break;
+    default:
+	break;
+    }
+
     switch (data->type) {
     case drive_object:
 	status = set_drive_state(objindex, drive_up, flags);