--- a/sys/dev/disk/advansys/advlib.c
+++ b/sys/dev/disk/advansys/advlib.c
@@ -1706,6 +1706,13 @@ adv_send_scsi_queue(struct adv_softc *adv, struct adv_scsi_q *scsiq,
 
 	retval = 1;
 	free_q_head = adv_read_lram_16(adv, ADVV_FREE_Q_HEAD_W) & 0xFF;
+	/*
+	 * The free queue head lives in RISC-maintained LRAM.  Never let a
+	 * stale/corrupt value select a sense DMA slot outside the
+	 * sense_buffers arena (advansys.c sizes it max_openings entries).
+	 */
+	if (free_q_head < ADV_MIN_ACTIVE_QNO ||
+	    free_q_head > adv->max_openings)
+		return (retval);
 	if ((next_qp = adv_alloc_free_queues(adv, free_q_head, n_q_required))
 	    != ADV_QLINK_END) {
 		scsiq->q1.q_no = free_q_head;