--- a/sys/dev/netif/ath/ath_hal/ar5212/ar2316.c	2026-09-22 16:03:01.365463540 +0000
+++ b/sys/dev/netif/ath/ath_hal/ar5212/ar2316.c	2026-09-22 16:03:01.389463221 +0000
@@ -459,6 +459,15 @@
 
 		sizeCurrVpdTable = Pmax_t2[ii] - Pmin_t2[ii];
 		tgtIndex = pPdGainBoundaries[ii] + pdGainOverlap_t2 - Pmin_t2[ii];
+		/*
+		 * A flat (or single-step) EEPROM power curve for this
+		 * pdGain makes sizeCurrVpdTable 0 (or 1); the reads
+		 * VpdTable_I[ii][sizeCurrVpdTable-1/-2] below wrap the
+		 * uint32 index to 0xFFFFFFFF/0xFFFFFFFE and read at
+		 * row + 0x1FFFFFFFE bytes.  Clamp to keep them in-row.
+		 */
+		if (sizeCurrVpdTable < 2)
+			sizeCurrVpdTable = 2;
 		maxIndex = (tgtIndex < sizeCurrVpdTable) ? tgtIndex : sizeCurrVpdTable;
 
 		while (ss < (int16_t)maxIndex)