diff --git a/sys/dev/netif/ath/ath/if_ath_ioctl.c b/sys/dev/netif/ath/ath/if_ath_ioctl.c
--- a/sys/dev/netif/ath/ath/if_ath_ioctl.c
+++ b/sys/dev/netif/ath/ath/if_ath_ioctl.c
@@ -198,7 +198,7 @@
 		 * pointer for us to use below in reclaiming the buffer;
 		 * may want to be more defensive.
 		 */
-		outdata = kmalloc(outsize, M_TEMP, M_NOWAIT);
+		outdata = kmalloc(outsize, M_TEMP, M_NOWAIT | M_ZERO);
 		if (outdata == NULL) {
 			error = ENOMEM;
 			goto bad;
diff --git a/sys/dev/netif/ath/ath_hal/ah.c b/sys/dev/netif/ath/ath_hal/ah.c
--- a/sys/dev/netif/ath/ath_hal/ah.c
+++ b/sys/dev/netif/ath/ath_hal/ah.c
@@ -847,12 +847,17 @@
 
 static u_int
 ath_hal_getregdump(struct ath_hal *ah, const HAL_REGRANGE *regs,
-	void *dstbuf, int space)
+	void *dstbuf, int space, uint32_t argsize)
 {
 	uint32_t *dp = dstbuf;
 	int i;
+	uint32_t nregs;
 
-	for (i = 0; space >= 2*sizeof(uint32_t); i++) {
+	if (argsize % sizeof(HAL_REGRANGE) != 0)
+		return (0);
+	nregs = argsize / sizeof(HAL_REGRANGE);
+
+	for (i = 0; i < nregs && space >= 2*sizeof(uint32_t); i++) {
 		uint32_t r = regs[i].start;
 		uint32_t e = regs[i].end;
 		*dp++ = r;
@@ -888,7 +893,8 @@
 		*resultsize = sizeof(HAL_REVS);
 		return AH_TRUE;
 	case HAL_DIAG_REGS:
-		*resultsize = ath_hal_getregdump(ah, args, *result,*resultsize);
+		*resultsize = ath_hal_getregdump(ah, args, *result,*resultsize,
+						     argsize);
 		return AH_TRUE;
 	case HAL_DIAG_SETREGS:
 		ath_hal_setregs(ah, args, argsize);