--- /home/maxx/dfbsd/dfbsd/sys/dev/disk/isp/isp.c	2026-06-29 12:51:18.000000000 +0000
+++ sys/dev/disk/isp/isp.c	2026-10-24 09:11:15.579214449 +0000
@@ -5118,7 +5118,7 @@
 			 * If somebody updated the output pointer, then reset
 			 * optr to be one more than the updated amount.
 			 */
-			while (tsto != oop) {
+			if (tsto != oop) {
 				optr = ISP_NXT_QENTRY(tsto,
 				    RESULT_QUEUE_LEN(isp));
 			}
@@ -5436,6 +5436,12 @@
 	if (mbox != ASYNC_RIO32_2) {
 		if (IS_DUALBUS(isp)) {
 			chan = ISP_READ(isp, OUTMAILBOX6);
+			if (chan >= isp->isp_nchan) {
+				isp_prt(isp, ISP_LOGWARN,
+				    "bad channel %u in async event 0x%x",
+				    chan, mbox);
+				return (acked);
+			}
 		}
 	}
 	isp_prt(isp, ISP_LOGDEBUG2, "Async Mbox 0x%x", mbox);