--- a/sys/dev/raid/ciss/ciss.c
+++ b/sys/dev/raid/ciss/ciss.c
@@ -3862,9 +3862,15 @@
                            CISS_MAX_LOGICAL);
     if (cll == NULL)
         return;
 
-    ndrives = (ntohl(cll->list_size) / sizeof(union ciss_device_address));
+    ndrives = (ntohl(cll->list_size) / sizeof(union ciss_device_address));
+    if ((ndrives < 0) || (ndrives > CISS_MAX_LOGICAL)) {
+	ciss_printf(sc, "adapter claims to report absurd number of logical drives (%d > %d)\n",
+		    ndrives, CISS_MAX_LOGICAL);
+	kfree(cll, CISS_MALLOC_CLASS);
+	return;
+    }
 
     /*
      * Delete any of the drives which were destroyed by the
      * firmware.
@@ -3897,9 +3897,13 @@
 	int	bus, target;
 
 	bus 	= CISS_LUN_TO_BUS(cll->lun[i].logical.lun);
 	target	= CISS_LUN_TO_TARGET(cll->lun[i].logical.lun);
-	ld	= &sc->ciss_logical[bus][target];
+	if (bus >= sc->ciss_max_logical_bus || target >= CISS_MAX_LOGICAL) {
+		ciss_printf(sc, "logical drive bus %d target %d out of range\n", bus, target);
+		continue;
+	}
+	ld	= &sc->ciss_logical[bus][target];
 
 	if (ld->cl_update == 0)
 		continue;