diff --git a/sys/dev/raid/ips/ips.c b/sys/dev/raid/ips/ips.c
--- a/sys/dev/raid/ips/ips.c
+++ b/sys/dev/raid/ips/ips.c
@@ -567,6 +567,10 @@
 	while ((status.value = ips_read_4(sc, MORPHEUS_REG_OQPR))
 	       != 0xffffffff) {
 		cmdnumber = status.fields.command_id;
+		if (cmdnumber >= sc->max_cmds) {
+			device_printf(sc->dev, "ips: bad command_id %d (max %d)\n", cmdnumber, sc->max_cmds);
+			break;
+		}
 		command = &sc->commandarray[cmdnumber];
 		command->status.value = status.value;
 		command->timeout = 0;