--- a/sys/kern/subr_gtaskqueue.c
+++ b/sys/kern/subr_gtaskqueue.c
@@ -785,6 +814,18 @@
 	struct taskqgroup *qgroup;
 	int cpu, i, j;
 
+	/*
+	 * tqg_queue[] is a fixed MAXCPU-entry array that is the bulk of
+	 * the kmalloc'd object; an unvalidated cnt larger than MAXCPU
+	 * makes taskqgroup_cpu_create() write past the allocation.
+	 */
+	if (cnt < 1)
+		cnt = 1;
+	if (cnt > MAXCPU) {
+		kprintf("%s: %s cnt %d > MAXCPU %d, clamping\n",
+		    __func__, name ? name : "?", cnt, MAXCPU);
+		cnt = MAXCPU;
+	}
 	qgroup = kmalloc(sizeof(*qgroup), M_GTASKQUEUE, M_WAITOK | M_ZERO);
 	lockinit(&qgroup->tqg_lock, "taskqgroup", 0, 0);
 	qgroup->tqg_name = name;