--- a/sys/dev/netif/ath/ath_hal/ar5211/ar5211_xmit.c
+++ b/sys/dev/netif/ath/ath_hal/ar5211/ar5211_xmit.c
@@ -81,7 +81,8 @@
 {
 	struct ath_hal_5211 *ahp = AH5211(ah);
 
-	if (q >= HAL_NUM_TX_QUEUES) {
+	/* NB: q is signed; reject negative before it reaches ah_txq[] */
+	if (q < 0 || q >= HAL_NUM_TX_QUEUES) {
 		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: invalid queue num %u\n",
 		    __func__, q);
 		return AH_FALSE;
@@ -97,7 +98,8 @@
 {
 	struct ath_hal_5211 *ahp = AH5211(ah);
 
-	if (q >= HAL_NUM_TX_QUEUES) {
+	/* NB: q is signed; reject negative before it reaches ah_txq[] */
+	if (q < 0 || q >= HAL_NUM_TX_QUEUES) {
 		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: invalid queue num %u\n",
 		    __func__, q);
 		return AH_FALSE;
@@ -402,7 +404,11 @@
 uint32_t
 ar5211GetTxDP(struct ath_hal *ah, u_int q)
 {
-	HALASSERT(q < HAL_NUM_TX_QUEUES);
+	if (q >= HAL_NUM_TX_QUEUES) {
+		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: invalid queue num %u\n",
+		    __func__, q);
+		return 0;
+	}
 	return OS_REG_READ(ah, AR_QTXDP(q));
 }
 
@@ -412,7 +418,11 @@
 HAL_BOOL
 ar5211SetTxDP(struct ath_hal *ah, u_int q, uint32_t txdp)
 {
-	HALASSERT(q < HAL_NUM_TX_QUEUES);
+	if (q >= HAL_NUM_TX_QUEUES) {
+		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: invalid queue num %u\n",
+		    __func__, q);
+		return AH_FALSE;
+	}
 	HALASSERT(AH5211(ah)->ah_txq[q].tqi_type != HAL_TX_QUEUE_INACTIVE);
 
 	/*
@@ -432,7 +442,11 @@
 HAL_BOOL
 ar5211StartTxDma(struct ath_hal *ah, u_int q)
 {
-	HALASSERT(q < HAL_NUM_TX_QUEUES);
+	if (q >= HAL_NUM_TX_QUEUES) {
+		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: invalid queue num %u\n",
+		    __func__, q);
+		return AH_FALSE;
+	}
 	HALASSERT(AH5211(ah)->ah_txq[q].tqi_type != HAL_TX_QUEUE_INACTIVE);
 
 	/* Check that queue is not already active */
@@ -455,7 +469,11 @@
 {
 	uint32_t n;
 
-	HALASSERT(q < HAL_NUM_TX_QUEUES);
+	if (q >= HAL_NUM_TX_QUEUES) {
+		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: invalid queue num %u\n",
+		    __func__, q);
+		return 0;
+	}
 	HALASSERT(AH5211(ah)->ah_txq[q].tqi_type != HAL_TX_QUEUE_INACTIVE);
 
 	n = OS_REG_READ(ah, AR_QSTS(q)) & AR_Q_STS_PEND_FR_CNT_M;
@@ -477,7 +495,11 @@
 {
 	int i;
 
-	HALASSERT(q < HAL_NUM_TX_QUEUES);
+	if (q >= HAL_NUM_TX_QUEUES) {
+		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: invalid queue num %u\n",
+		    __func__, q);
+		return AH_FALSE;
+	}
 	HALASSERT(AH5211(ah)->ah_txq[q].tqi_type != HAL_TX_QUEUE_INACTIVE);
 
 	OS_REG_WRITE(ah, AR_Q_TXD, 1<<q);