diff --git a/sys/dev/netif/ath/ath_hal/ar9002/ar9280_olc.c b/sys/dev/netif/ath/ath_hal/ar9002/ar9280_olc.c
--- a/sys/dev/netif/ath/ath_hal/ar9002/ar9280_olc.c
+++ b/sys/dev/netif/ath/ath_hal/ar9002/ar9280_olc.c
@@ -215,6 +215,18 @@
 #define NUM_PDADC(diff) (AR5416_NUM_PDADC_VALUES - diff)
 	uint16_t k;
 
+	/*
+	 * diff is the number of half-dB steps to shift the PDADC table; it
+	 * must be a small non-negative value strictly less than
+	 * AR5416_NUM_PDADC_VALUES.  A forged EEPROM pwr_table_offset can
+	 * otherwise drive diff negative (making NUM_PDADC > 128, overflowing
+	 * the write past pdadcValues[]) or greater than 128 (making NUM_PDADC
+	 * negative, wrapping to ~65K after the uint16_t cast on the loop bound
+	 * and corrupting up to 64 KB of kernel BSS).  Reject both cases.
+	 */
+	if (diff < 0 || diff >= AR5416_NUM_PDADC_VALUES)
+		return;
+
 	/* If this is a board that has a pwrTableOffset that differs from
 	 * the default AR5416_PWR_TABLE_OFFSET_DB then the start of the
 	 * pdadc vs pwr table needs to be adjusted prior to writing to the