--- a/sys/dev/raid/arcmsr/arcmsr.c
+++ b/sys/dev/raid/arcmsr/arcmsr.c
@@ -818,6 +818,13 @@
 		srb = (struct CommandControlBlock *)(acb->vir2phy_offset+(flag_srb & 0xFFFFFFE0)); /*frame must be 32 bytes aligned*/
 		break;
 	case ACB_ADAPTER_TYPE_E:
+		/* flag_srb is a firmware-supplied SMID; only
+		 * indexes 0..ARCMSR_MAX_FREESRB_NUM-1 are valid */
+		if (flag_srb >= ARCMSR_MAX_FREESRB_NUM) {
+			kprintf("arcmsr%d: bogus completion SMID 0x%x\n",
+			    acb->pci_unit, flag_srb);
+			return;
+		}
 		srb = acb->psrb_pool[flag_srb];
 		break;
 	case ACB_ADAPTER_TYPE_A:
@@ -3579,6 +3586,11 @@
 		if (doneq_index >= acb->completionQ_entry)
 			doneq_index = 0;
 		acb->doneq_index = doneq_index;
+		if (cmdSMID >= ARCMSR_MAX_FREESRB_NUM) {
+			kprintf("arcmsr%d: bogus completion SMID 0x%x\n",
+			    acb->pci_unit, cmdSMID);
+			continue;
+		}
 		srb = acb->psrb_pool[cmdSMID];
 		error = (acb->pCompletionQ[doneq_index].cmdFlag & ARCMSR_SRBREPLY_FLAG_ERROR_MODE1) ? TRUE : FALSE;
 		if (poll_srb != NULL)