--- sys/kern/subr_cpu_topology.c	2026-06-29 12:51:19.000000000 +0000
+++ /tmp/opencode/v26/fixtree/sys/kern/subr_cpu_topology.c	2026-10-24 16:33:07.877714441 +0000
@@ -129,6 +129,18 @@
 
 	if (node->child_no == 0) {
 		*apicid = get_next_valid_apicid(*apicid);
+		/*
+		 * DF-2847: get_next_valid_apicid() returns -1 when the
+		 * tree wants more leaves than there are registered APIC
+		 * IDs.  Feeding -1 to get_cpuid_from_apicid() reads
+		 * apic_id_to_cpu_id[-1] out of bounds and the garbage
+		 * value is then used as a cpumask bit index.
+		 */
+		if (*apicid < 0) {
+			kprintf("cpu_topology: APIC ID space exhausted at "
+				"leaf, leaving mask empty\n");
+			return;
+		}
 		CPUMASK_ASSBIT(node->members, get_cpuid_from_apicid(*apicid));
 		return;
 	}