--- a/sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c
+++ b/sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c
@@ -37,7 +37,8 @@
 {
 	struct ath_hal_5210 *ahp = AH5210(ah);
 
-	if (q >= HAL_NUM_TX_QUEUES) {
+	/* NB: q is signed; reject negative before it reaches ah_txq[] */
+	if (q < 0 || q >= HAL_NUM_TX_QUEUES) {
 		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: invalid queue num %u\n",
 		    __func__, q);
 		return AH_FALSE;
@@ -53,7 +54,8 @@
 {
 	struct ath_hal_5210 *ahp = AH5210(ah);
 
-	if (q >= HAL_NUM_TX_QUEUES) {
+	/* NB: q is signed; reject negative before it reaches ah_txq[] */
+	if (q < 0 || q >= HAL_NUM_TX_QUEUES) {
 		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: invalid queue num %u\n",
 		    __func__, q);
 		return AH_FALSE;
@@ -259,7 +261,11 @@
 	struct ath_hal_5210 *ahp = AH5210(ah);
 	HAL_TX_QUEUE_INFO *qi;
 
-	HALASSERT(q < HAL_NUM_TX_QUEUES);
+	if (q >= HAL_NUM_TX_QUEUES) {
+		HALDEBUG(ah, HAL_DEBUG_ANY, "ar5210GetTxDP: invalid queue num %u\n",
+		    __func__, q);
+		return 0xffffffff;
+	}
 
 	qi = &ahp->ah_txq[q];
 	switch (qi->tqi_type) {
@@ -284,7 +290,11 @@
 	struct ath_hal_5210 *ahp = AH5210(ah);
 	HAL_TX_QUEUE_INFO *qi;
 
-	HALASSERT(q < HAL_NUM_TX_QUEUES);
+	if (q >= HAL_NUM_TX_QUEUES) {
+		HALDEBUG(ah, HAL_DEBUG_ANY, "ar5210SetTxDP: invalid queue num %u\n",
+		    __func__, q);
+		return AH_FALSE;
+	}
 
 	HALDEBUG(ah, HAL_DEBUG_TXQUEUE, "%s: queue %u 0x%x\n",
 	    __func__, q, txdp);
@@ -369,7 +379,11 @@
 	struct ath_hal_5210 *ahp = AH5210(ah);
 	HAL_TX_QUEUE_INFO *qi;
 
-	HALASSERT(q < HAL_NUM_TX_QUEUES);
+	if (q >= HAL_NUM_TX_QUEUES) {
+		HALDEBUG(ah, HAL_DEBUG_ANY, "ar5210StartTxDma: invalid queue num %u\n",
+		    __func__, q);
+		return AH_FALSE;
+	}
 
 	HALDEBUG(ah, HAL_DEBUG_TXQUEUE, "%s: queue %u\n", __func__, q);
 	qi = &ahp->ah_txq[q];
@@ -403,7 +417,11 @@
 	HAL_TX_QUEUE_INFO *qi;
 	uint32_t v;
 
-	HALASSERT(q < HAL_NUM_TX_QUEUES);
+	if (q >= HAL_NUM_TX_QUEUES) {
+		HALDEBUG(ah, HAL_DEBUG_ANY, "ar5210NumTxPending: invalid queue num %u\n",
+		    __func__, q);
+		return 0;
+	}
 
 	HALDEBUG(ah, HAL_DEBUG_TXQUEUE, "%s: queue %u\n", __func__, q);
 	qi = &ahp->ah_txq[q];
@@ -430,7 +448,11 @@
 	struct ath_hal_5210 *ahp = AH5210(ah);
 	HAL_TX_QUEUE_INFO *qi;
 
-	HALASSERT(q < HAL_NUM_TX_QUEUES);
+	if (q >= HAL_NUM_TX_QUEUES) {
+		HALDEBUG(ah, HAL_DEBUG_ANY, "ar5210StopTxDma: invalid queue num %u\n",
+		    __func__, q);
+		return AH_FALSE;
+	}
 
 	HALDEBUG(ah, HAL_DEBUG_TXQUEUE, "%s: queue %u\n", __func__, q);
 	qi = &ahp->ah_txq[q];