--- a/sys/dev/disk/isp/isp.c
+++ b/sys/dev/disk/isp/isp.c
@@ -5090,7 +5090,9 @@ isp_intr(ispsoftc_t *isp, uint32_t isr, uint16_t sema, uint16_t mbox)
 		} else if (etype == RQSTYPE_RIO1) {
 			isp_rio1_t *rio = (isp_rio1_t *) qe;
 			isp_get_rio1(isp, (isp_rio1_t *) hp, rio);
 			if (isp->isp_dblev & ISP_LOGDEBUG1) {
 				isp_print_bytes(isp, "Response Queue Entry", QENTRY_LEN, rio);
 			}
-			for (i = 0; i < rio->req_header.rqs_seqno; i++) {
+			for (i = 0; i < rio->req_header.rqs_seqno &&
+			    i < (int)NELEM(rio->req_handles); i++) {
 				isp_fastpost_complete(isp, rio->req_handles[i]);
 			}
 			if (isp->isp_fpcchiwater < rio->req_header.rqs_seqno) {