diff --git a/sys/dev/netif/ath/ath/if_ath_tx_edma.c b/sys/dev/netif/ath/ath/if_ath_tx_edma.c
--- a/sys/dev/netif/ath/ath/if_ath_tx_edma.c
+++ b/sys/dev/netif/ath/ath/if_ath_tx_edma.c
@@ -681,6 +681,11 @@
 		if (ts.ts_queue_id == sc->sc_bhalq)
 			continue;
 
+		if (ts.ts_queue_id >= HAL_NUM_TX_QUEUES) {
+			device_printf(sc->sc_dev, "%s: invalid tx queue id %u\n",
+			    __func__, ts.ts_queue_id);
+			break;
+		}
 		txq = &sc->sc_txq[ts.ts_queue_id];
 
 		ATH_TXQ_LOCK(txq);