--- /home/maxx/dfbsd/dfbsd/sys/dev/raid/aac/aac.c	2026-07-22 16:41:59.460308436 +0000
+++ /tmp/opencode/fix/aac.c	2026-09-16 10:59:46.436872478 +0000
@@ -850,6 +850,11 @@
 			AAC_CLEAR_ISTATUS(sc, AAC_DB_RESPONSE_READY);
 		} else {
 			fast = index & 1;
+			if ((index >> 2) >= sc->total_fibs) {
+				device_printf(sc->aac_dev,
+				    "BOGUS completion index %#x\n", index);
+				break;
+			}
 			cm = sc->aac_commands + (index >> 2);
 			fib = cm->cm_fib;
 			if (fast) {
@@ -1115,6 +1120,12 @@
 			break;	/* nothing to do */
 
 		/* get the command, unmap and hand off for processing */
+		if (fib->Header.SenderData >= sc->total_fibs) {
+			device_printf(sc->aac_dev,
+			    "BOGUS completion SenderData %u\n",
+			    fib->Header.SenderData);
+			break;
+		}
 		cm = sc->aac_commands + fib->Header.SenderData;
 		if (cm == NULL) {
 			AAC_PRINT_FIB(sc, fib);
@@ -2220,6 +2231,12 @@
 		 */
 		fib_index = (sc->aac_qentries[queue] + ci)->aq_fib_addr /
 			sizeof(struct aac_fib);
+		if (fib_index >= AAC_ADAPTER_FIBS) {
+			device_printf(sc->aac_dev,
+			    "BOGUS AIF fib index %u\n", fib_index);
+			error = EINVAL;
+			goto out;
+		}
 		*fib_addr = &sc->aac_common->ac_fibs[fib_index];
 		break;
 
@@ -2236,6 +2253,12 @@
 		 * field.
 		 */
 		fib_index = (sc->aac_qentries[queue] + ci)->aq_fib_addr;
+		if ((fib_index >> 2) >= sc->total_fibs) {
+			device_printf(sc->aac_dev,
+			    "BOGUS response index %u\n", fib_index);
+			error = EINVAL;
+			goto out;
+		}
 		cm = sc->aac_commands + (fib_index >> 2);
 		*fib_addr = cm->cm_fib;
 
@@ -3768,6 +3791,8 @@
 	lockmgr(&sc->aac_io_lock, LK_RELEASE);
 
 	found = 0;
+	if (businfo.BusCount > AAC_SCSI_MAX_PORTS)
+		businfo.BusCount = AAC_SCSI_MAX_PORTS;	/* BusValid[] size */
 	for (i = 0; i < businfo.BusCount; i++) {
 		if (businfo.BusValid[i] != AAC_BUS_VALID)
 			continue;