diff --git a/sys/dev/disk/nata/ata-pci.c b/sys/dev/disk/nata/ata-pci.c
--- a/sys/dev/disk/nata/ata-pci.c
+++ b/sys/dev/disk/nata/ata-pci.c
@@ -226,6 +226,14 @@
     if (ctlr->chipinit(dev))
 	return ENXIO;
 
+    /* Bound the channel count to interrupt[] capacity (8, see
+     * ata-pci.h:67 "XXX SOS max ch#").  AHCI parts (or a malicious /
+     * hotplug controller) can report up to 32 ports via CAP.NP+1 / PI,
+     * which would overflow the fixed interrupt[] table on attach and
+     * during IRQ dispatch (DF-1716). */
+    if (ctlr->channels > 8)
+	ctlr->channels = 8;
+
     /* attach all channels on this controller */
     for (unit = 0; unit < ctlr->channels; unit++) {
 	int freeunit = 2;