--- a/sys/dev/netif/bnx/if_bnx.c
+++ b/sys/dev/netif/bnx/if_bnx.c
@@ -5676,12 +5676,13 @@
 
 	ifnet_serialize_all(ifp);
 
-	if ((cntmax * sc->bnx_rx_retcnt) >= BGE_STD_RX_RING_CNT / 2) {
+	if (cntmax < 1 || (cntmax * sc->bnx_rx_retcnt) >=
+	    BGE_STD_RX_RING_CNT / 2) {
 		error = EINVAL;
 		goto back;
 	}
 
-	for (i = 0; i < sc->bnx_tx_ringcnt; ++i)
+	for (i = 0; i < sc->bnx_rx_retcnt; ++i)
 		sc->bnx_rx_ret_ring[i].bnx_rx_cntmax = cntmax;
 	error = 0;