diff --git a/sys/dev/virtual/virtio/virtio/virtqueue.c b/sys/dev/virtual/virtio/virtio/virtqueue.c
--- a/sys/dev/virtual/virtio/virtio/virtqueue.c
+++ b/sys/dev/virtual/virtio/virtio/virtqueue.c
@@ -557,6 +557,11 @@
 	uep = &vq->vq_ring.used->ring[used_idx];
 
 	desc_idx = (uint16_t) uep->id;
+	if (desc_idx >= vq->vq_nentries) {
+		VQASSERT(vq, 0, "invalid used idx %d (max %d)",
+		    desc_idx, vq->vq_nentries);
+		return (NULL);
+	}
 	if (len != NULL)
 		*len = uep->len;