--- /tmp/orig/dev/netif/ath/ath_dfs/null/dfs_null.c	2026-07-23 11:54:56.684817000 +0000
+++ dev/netif/ath/ath_dfs/null/dfs_null.c	2026-07-23 11:57:17.676284000 +0000
@@ -258,7 +258,8 @@
 	}
 	switch (id) {
 		case DFS_SET_THRESH:
-			if (insize < sizeof(HAL_PHYERR_PARAM)) {
+			if (!(ad->ad_id & ATH_DIAG_IN) || indata == NULL ||
+			    insize < sizeof(HAL_PHYERR_PARAM)) {
 				error = EINVAL;
 				break;
 			}
@@ -269,6 +270,10 @@
 			memset(&peout, 0, sizeof(peout));
 			outsize = sizeof(HAL_PHYERR_PARAM);
 			ath_hal_getdfsthresh(sc->sc_ah, &peout);
+			if (outdata == NULL) {
+				error = EINVAL;
+				break;
+			}
 			pe = (HAL_PHYERR_PARAM *) outdata;
 			memcpy(pe, &peout, sizeof(*pe));
 			break;