--- a/sys/netproto/802_11/wlan/ieee80211_radiotap.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/netproto/802_11/wlan/ieee80211_radiotap.c	2026-10-26 03:31:47.251168369 +0000
@@ -369,7 +369,7 @@
 	for (i = 0; i < IEEE80211_RADIOTAP_EXT; i++) {
 		if ((present & (1<<i)) == 0)
 			continue;
-		if (items[i].align == 0) {
+		if (i >= nitems(items) || items[i].align == 0) {
 			/* NB: unidentified element, don't guess */
 			kprintf("%s: unknown item %d\n", __func__, i);
 			return -1;