diff --git a/sys/dev/disk/dm/flakey/dm_target_flakey.c b/sys/dev/disk/dm/flakey/dm_target_flakey.c
--- a/sys/dev/disk/dm/flakey/dm_target_flakey.c
+++ b/sys/dev/disk/dm/flakey/dm_target_flakey.c
@@ -123,6 +123,7 @@
 _init_features(dm_target_flakey_config_t *tfc, int argc, char **argv)
 {
 	char *arg;
+	int64_t feature_argc;
 	unsigned int value;
 
 	if (argc == 0)
@@ -130,8 +133,13 @@
 
-	argc = atoi64(*argv++);  /* # of args for features */
-	if (argc > 6) {
-		kprintf("Invalid # of feature args %d\n", argc);
+	feature_argc = atoi64(*argv++);  /* # of args for features */
+	/* Validate before truncating to int: atoi64 returns uint64_t, so
+	 * values >= 2^31 wrap to negative when assigned to int, bypassing
+	 * the > 6 guard and causing an OOB argv walk. */
+	if (feature_argc < 0 || feature_argc > 6) {
+		kprintf("Invalid # of feature args %lld\n",
+		    (long long)feature_argc);
 		return EINVAL;
 	}
+	argc = (int)feature_argc;
 
 	while (argc) {