diff --git a/sys/dev/netif/ath/ath_hal/ar5312/ar5312_eeprom.c b/sys/dev/netif/ath/ath_hal/ar5312/ar5312_eeprom.c
--- a/sys/dev/netif/ath/ath_hal/ar5312/ar5312_eeprom.c
+++ b/sys/dev/netif/ath/ath_hal/ar5312/ar5312_eeprom.c
@@ -28,6 +28,10 @@
 #include "ar5312/ar5312reg.h"
 #include "ar5212/ar5212desc.h"
 
+/* Maximum 16-bit EEPROM word offset accepted from callers; bounds the
+   memory-mapped radio-config read against arbitrary kernel-memory access. */
+#define AR5312_EEPROM_MAX	1024
+
 /*
  * Read 16 bits of data from offset into *data
  */
@@ -37,7 +41,12 @@
         int i,offset;
 	const char *eepromAddr = AR5312_RADIOCONFIG(ah);
 	uint8_t *data;
-	
+
+	/* Reject an unmapped radio-config pointer and bound the caller-supplied
+	   offset to the radio-config flash window.  Without this 2*off indexes
+	   arbitrary kernel memory (info leak) or faults off the mapping (DoS). */
+	if (eepromAddr == NULL || off >= AR5312_EEPROM_MAX)
+		return AH_FALSE;
 	data = (uint8_t *) dataIn;
 	for (i=0,offset=2*off; i<2; i++,offset++) {
 		data[i] = eepromAddr[offset];