--- a/sys/kern/lwkt_token.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/kern/lwkt_token.c	2026-10-26 00:46:25.929086774 +0000
@@ -949,6 +959,17 @@
 
 	crit_enter();
 
+	/*
+	 * The swap is only defined with at least two tokens held.
+	 * Bail out unconditionally (not just under INVARIANTS) so a
+	 * buggy caller cannot corrupt memory before td_toks_array on
+	 * production builds.
+	 */
+	if (td->td_toks_stop < &td->td_toks_array[2]) {
+		crit_exit();
+		return;
+	}
+
 	ref1 = td->td_toks_stop - 1;
 	ref2 = td->td_toks_stop - 2;
 	KKASSERT(ref1 >= &td->td_toks_base);