diff --git a/sys/dev/acpica/acpi_hp/acpi_hp.c b/sys/dev/acpica/acpi_hp/acpi_hp.c
--- a/sys/dev/acpica/acpi_hp/acpi_hp.c
+++ b/sys/dev/acpica/acpi_hp/acpi_hp.c
@@ -1178,7 +1178,13 @@
 						instance = maxInstance;
 					}
 					else {
-						pos = sc->cmi_order_size;
+							/* cmi_order[] is fixed at 128 entries; stop growing once full
+							   to avoid a heap overflow past the softc. */
+							if (sc->cmi_order_size >= nitems(sc->cmi_order)) {
+								instance = maxInstance;
+								break;
+							}
+							pos = sc->cmi_order_size;
 						for (i=0;
 						  i<sc->cmi_order_size && i<127;
 						     ++i) {