--- a/sys/vfs/hammer2/hammer2_freemap.c
+++ b/sys/vfs/hammer2/hammer2_freemap.c
@@ -673,10 +673,15 @@
 		default:
 			break;
 		}
-		if (i >= 0) {
+		/*
+		 * DF-2653: reject sub_key-derived indexes that do not leave
+		 * room for bmradix bits inside the 64-bit element (a crafted
+		 * DATA bref key that is not radix-aligned gives j=62 with
+		 * bmradix=8).  Fall back to the general scan.
+		 */
+		if (i >= 0 && j + bmradix <= HAMMER2_BMAP_BITS_PER_ELEMENT) {
 			KKASSERT(i < HAMMER2_BMAP_ELEMENTS &&
 				 j < 2 * HAMMER2_BMAP_BLOCKS_PER_ELEMENT);
-			KKASSERT(j + bmradix <= HAMMER2_BMAP_BITS_PER_ELEMENT);
 			bmmask = (bmradix == HAMMER2_BMAP_BITS_PER_ELEMENT) ?
 				 HAMMER2_BMAP_ALLONES :
 				 ((hammer2_bitmap_t)1 << bmradix) - 1;