--- a/sys/dev/video/cxm/cxm_tuner.c
+++ b/sys/dev/video/cxm/cxm_tuner.c
@@ -722,9 +722,18 @@
 
 		N = (16 * osc_freq) / 1000;
 
+	{
+		const struct cxm_tuner_band_code *band_end =
+		    &sc->tuner->band_codes[
+			NUM_ELEMENTS(sc->tuner->band_codes)];
+
 		for (band_code = sc->tuner->band_codes;
-		     band_code->freq > freq; band_code++)
+		     band_code < band_end && band_code->freq > freq;
+		     band_code++)
 			;
+		if (band_code >= band_end)
+			return -1;
+	}
 
 		if (freq >= sc->tuner_freq) {
 			msg[0] = (unsigned char)(N >> 8);
@@ -786,9 +795,18 @@
 	    || channel > channels->max_channel)
 		return -1;
 
-	for (assignments = channels->assignments;
-	     assignments->channel > channel; assignments++)
-		;
+	{
+		const struct cxm_tuner_channel_assignment *assign_end =
+		    &channels->assignments[
+			NUM_ELEMENTS(channels->assignments)];
+
+		for (assignments = channels->assignments;
+		     assignments < assign_end &&
+		     assignments->channel > channel; assignments++)
+			;
+		if (assignments == assign_end)
+			return -1;
+	}
 
 	if (!assignments->freq)
 		return -1;