--- a/sys/dev/raid/hptiop/hptiop.c	2026-09-17 06:16:59.056779292 +0000
+++ b/sys/dev/raid/hptiop/hptiop.c	2026-09-17 06:16:59.116778527 +0000
@@ -1932,6 +1932,16 @@ static int hptiop_attach(device_t dev)
 	hba->max_request_size = iop_config.request_size;
 	hba->max_sg_count = iop_config.max_sg_count;
 
+	/* the get_config block is device-fed; validate before use */
+	if (hba->max_requests == 0) {
+		device_printf(dev, "invalid iop config: max_requests\n");
+		goto get_config_failed;
+	}
+	if (hba->max_sg_count == 0)
+		hba->max_sg_count = 1;	/* avoid maxsize underflow */
+	if (hba->max_devices == 0)
+		hba->max_devices = 1;
+
 	if (hba->ops->family == MVFREY_BASED_IOP) {
 		if (hba->ops->internal_memalloc(hba)) {
 			device_printf(dev, "alloc srb_dmat failed\n");