--- a/sys/dev/raid/mly/mly.c
+++ b/sys/dev/raid/mly/mly.c
@@ -780,6 +780,21 @@ mly_get_controllerinfo(struct mly_softc *sc)
     if (status != 0)
 	return(EIO);
 
+    /*
+     * The controller reports channel counts as 8-bit fields; the driver
+     * arrays are sized MLY_MAX_CHANNELS (6).  A buggy or hostile
+     * controller reporting large counts makes mly_cam_attach() write
+     * cam_sim pointers past mly_cam_sim[] and mly_scan_devices()/
+     * mly_periodic() walk mly_btl[][] far out of bounds.
+     */
+    if (sc->mly_controllerinfo->physical_channels_present +
+	sc->mly_controllerinfo->virtual_channels_present > MLY_MAX_CHANNELS) {
+	mly_printf(sc, "controller reports %d+%d channels, more than the %d "
+		   "supported; refusing to attach\n",
+		   sc->mly_controllerinfo->physical_channels_present,
+		   sc->mly_controllerinfo->virtual_channels_present,
+		   MLY_MAX_CHANNELS);
+	return(EIO);
+    }
+
     /* build the getcontrollerparameter ioctl and send it */
     bzero(&mci, sizeof(mci));
     sc->mly_controllerparam = NULL;