--- a/sys/dev/netif/ath/ath_hal/ar5210/ar5210_misc.c
+++ b/sys/dev/netif/ath/ath_hal/ar5210/ar5210_misc.c
@@ -633,7 +633,8 @@ ar5210GetDiagState(struct ath_hal *ah, int request,
 	switch (request) {
 	case HAL_DIAG_EEPROM:
 		/* XXX */
 		break;
 	case HAL_DIAG_EEREAD:
-		if (argsize != sizeof(uint16_t))
+		if (argsize != sizeof(uint16_t) || args == NULL ||
+		    result == NULL || *result == NULL)
 			return AH_FALSE;
 		pcicfg = OS_REG_READ(ah, AR_PCICFG);
 		OS_REG_WRITE(ah, AR_PCICFG, pcicfg | AR_PCICFG_EEPROMSEL);
--- a/sys/dev/netif/ath/ath_hal/ah.c
+++ b/sys/dev/netif/ath/ath_hal/ah.c
@@ -899,7 +899,9 @@ ath_hal_getdiagstate(struct ath_hal *ah, int request,
 		*resultsize = sizeof(AH_PRIVATE(ah)->ah_fatalState);
 		return AH_TRUE;
 	case HAL_DIAG_EEREAD:
-		if (argsize != sizeof(uint16_t))
+		if (argsize != sizeof(uint16_t) || args == NULL ||
+		    result == NULL || *result == NULL)
 			return AH_FALSE;
 		if (!ath_hal_eepromRead(ah, *(const uint16_t *)args, *result))
 			return AH_FALSE;