--- a/sys/dev/sound/pci/aureal.c
+++ b/sys/dev/sound/pci/aureal.c
@@ -588,11 +588,21 @@ au_pci_attach(device_t dev)
 		if (!reg[j]) {
 			type[j] = SYS_RES_IOPORT;
 			reg[j] = bus_alloc_resource_any(dev, type[j],
 							&regid[j], RF_ACTIVE);
 		}
 		if (reg[j]) {
+			if (j >= (int)(sizeof(au->st)/sizeof(au->st[0]))) {
+				/* more mappable BARs than au_info holds slots
+				 * for: bail out instead of writing past
+				 * st[]/sh[] into parent_dmat/lock/x[]
+				 * (DF-4726, OOB softc write). */
+				device_printf(dev, "too many usable BARs\n");
+				goto bad;
+			}
+			/* NB: store under j (mapped count), not the BAR
+			 * index i — i runs to PCI_MAXMAPS_0-1 (6) and
+			 * st[]/sh[] only have 3 slots.  The driver only
+			 * ever touches map 0, so mapping the first three
+			 * usable BARs is sufficient. */
+			au->st[j] = rman_get_bustag(reg[j]);
+			au->sh[j] = rman_get_bushandle(reg[j]);
+			mapped++;
 		}