--- a/sys/dev/netif/ath/ath_hal/ar5212/ar5212_ani.c
+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar5212_ani.c
@@ -183,6 +183,16 @@
 {
 	struct ath_hal_5212 *ahp = AH5212(ah);
 	HAL_BOOL ena = (ahp->ah_procPhyErr & HAL_ANI_ENA) != 0;
+
+	/* Validate max level fields against fixed-size array bounds. */
+	if (params24->maxNoiseImmunityLevel > nitems(params24->totalSizeDesired) ||
+	    params24->maxSpurImmunityLevel > nitems(params24->cycPwrThr1) ||
+	    params24->maxFirstepLevel > nitems(params24->firstep))
+		return AH_FALSE;
+	if (params5->maxNoiseImmunityLevel > nitems(params5->totalSizeDesired) ||
+	    params5->maxSpurImmunityLevel > nitems(params5->cycPwrThr1) ||
+	    params5->maxFirstepLevel > nitems(params5->firstep))
+		return AH_FALSE;
 
 	ar5212AniControl(ah, HAL_ANI_MODE, AH_FALSE);