diff --git a/sys/dev/powermng/powernow/powernow.c b/sys/dev/powermng/powernow/powernow.c
--- a/sys/dev/powermng/powernow/powernow.c
+++ b/sys/dev/powermng/powernow/powernow.c
@@ -140,6 +140,15 @@
 {
 	int		i         , j, n;
 	struct k8pnow_state state;
+
+	/* pst->n_states is uint8 (0..255) and comes from BIOS PSB/PST tables.
+	 * state_table[] has only POWERNOW_MAX_STATES=16 slots; bound-check
+	 * before the insertion-sort loop below overruns it. */
+	if (cstate->n_states > POWERNOW_MAX_STATES) {
+		kprintf("powernow: PSB n_states %u > %d, ignoring PST\n",
+			cstate->n_states, POWERNOW_MAX_STATES);
+		return 0;
+	}
 	for (n = 0, i = 0; i < cstate->n_states; i++) {
 		state.fid = *p++;
 		state.vid = *p++;