diff --git a/sys/dev/raid/vinum/vinumrevive.c b/sys/dev/raid/vinum/vinumrevive.c
--- a/sys/dev/raid/vinum/vinumrevive.c
+++ b/sys/dev/raid/vinum/vinumrevive.c
@@ -261,6 +261,13 @@
     pbp = NULL;
     reply = (struct _ioctl_reply *) data;
     reply->error = EAGAIN;				    /* expect to repeat this call */
+    /* data->index is a user-controlled int from the VINUM_PARITYOP ioctl;
+     * validate before indexing PLEX[] to avoid OOB. */
+    if (plexno < 0 || (unsigned)plexno >= vinum_conf.plexes_allocated) {
+	reply->error = EINVAL;
+	return;
+    }
+
     plex = &PLEX[plexno];
     if (!isparity(plex)) {				    /* not RAID-4 or RAID-5 */
 	reply->error = EINVAL;