--- a/sys/dev/netif/ral/rt2560.c
+++ b/sys/dev/netif/ral/rt2560.c
@@ -2207,7 +2207,14 @@
 
 	/* dual-band RF */
 	case RT2560_RF_5222:
-		for (i = 0; rt2560_rf5222[i].chan != chan; i++);
+		for (i = 0; i < nitems(rt2560_rf5222) &&
+		    rt2560_rf5222[i].chan != chan; i++)
+			;
+		if (i == nitems(rt2560_rf5222)) {
+			device_printf(sc->sc_dev,
+			    "unknown channel %u for RF5222\n", chan);
+			break;
+		}
 
 		rt2560_rf_write(sc, RAL_RF1, rt2560_rf5222[i].r1);
 		rt2560_rf_write(sc, RAL_RF2, rt2560_rf5222[i].r2);