--- a/sys/dev/raid/mpr/mpr_mapping.c
+++ b/sys/dev/raid/mpr/mpr_mapping.c
@@ -116,6 +116,25 @@
 	if (!sc->is_dpm_enable)
 		return 0;
 
+	/*
+	 * The enclosure's start_index is copied verbatim from the DPM page0
+	 * DeviceIndex during _mapping_process_dpm_pg0() and is never
+	 * validated against the mapping table size. When the entry's slot
+	 * count is zero the reservation loop in that function does not run
+	 * at all, so a corrupt/malicious DPM entry with an out-of-range
+	 * DeviceIndex survives ingestion quietly and is dereferenced here
+	 * as a wild mapping_table index. Reject invalid start indices
+	 * before touching the mapping table.
+	 */
+	if (et_entry->start_index == MPR_MAPTABLE_BAD_IDX ||
+	    et_entry->start_index >= sc->max_devices) {
+		mpr_dprint(sc, MPR_ERROR | MPR_MAPPING, "%s: enclosure with "
+		    "DPM entry %d has an invalid start index 0x%08x.\n",
+		    __func__, et_entry->dpm_entry_num,
+		    et_entry->start_index);
+		return -1;
+	}
+
 	memset(&config_page, 0, sizeof(Mpi2DriverMappingPage0_t));
 	memcpy(&config_page.Header, (u8 *) sc->dpm_pg0,
 	    sizeof(MPI2_CONFIG_EXTENDED_PAGE_HEADER));