--- a/sys/dev/netif/ath/ath_hal/ah_eeprom_v3.c	2026-09-18 19:18:25.962876082 +0000
+++ b/sys/dev/netif/ath/ath_hal/ah_eeprom_v3.c	2026-09-18 19:18:25.974875928 +0000
@@ -1729,6 +1729,14 @@
 	case HAL_DIAG_EEPROM_EXP_11A:
 	case HAL_DIAG_EEPROM_EXP_11B:
 	case HAL_DIAG_EEPROM_EXP_11G:
+		/*
+		 * The expansion arrays only exist for 5112-layout
+		 * (EEP_MAP 1) EEPROMs.  On 2413-layout cards ee_u holds
+		 * RAW_DATA_STRUCT_2413 datasets and reinterpreting them
+		 * here yields a bogus pointer/size handed to copyout().
+		 */
+		if (ee->ee_version < AR_EEPROM_VER4_0 || ee->ee_eepMap != 1)
+			return AH_FALSE;
 		pe = &ee->ee_modePowerArray5112[
 		    request - HAL_DIAG_EEPROM_EXP_11A];
 		*result = pe->pChannels;