--- a/sys/dev/netif/ath/ath_hal/ah_eeprom_v3.c	2026-09-18 19:16:28.044395792 +0000
+++ b/sys/dev/netif/ath/ath_hal/ah_eeprom_v3.c	2026-09-18 19:16:28.072395431 +0000
@@ -205,6 +205,18 @@
 			xgainList[kk++] = jj;
 		}
 	}
+	if (kk == 0) {
+		/*
+		 * xpdMask had no set bits, so xgainList[] still holds the
+		 * 0xDEAD sentinel which must never be used as an index
+		 * into pDataPerXPD[] (a wild OOB write ~1.1MB past the
+		 * heap allocation).  Fail the attach instead.
+		 */
+		HALDEBUG(ah, HAL_DEBUG_ANY,
+		    "%s: no xpdGains in dataset (xpdMask 0x%x)\n",
+		    __func__, xpdMask);
+		return AH_FALSE;
+	}
 
 	pPowerExpn->numChannels = pCalDataset->numChannels;
 	if (pPowerExpn->numChannels == 0) {