--- a/sys/dev/netif/iwm/if_iwm.c	2026-09-15 10:51:39.216775004 +0000
+++ b/sys/dev/netif/iwm/if_iwm.c	2026-09-15 10:51:59.596513305 +0000
@@ -3598,6 +3598,13 @@
 	idx = cmd_hdr->idx;
 	qid = cmd_hdr->qid;
 
+	if (qid >= nitems(sc->txq) || idx >= IWM_TX_RING_COUNT) {
+		device_printf(sc->sc_dev,
+		    "%s: invalid qid %d idx %d in TX completion, dropping\n",
+		    __func__, qid, idx);
+		return;
+	}
+
 	ring = &sc->txq[qid];
 	txd = &ring->data[idx];
 	in = txd->in;