--- a/sys/dev/raid/mpr/mpr_table.c
+++ b/sys/dev/raid/mpr/mpr_table.c
@@ -398,7 +398,12 @@ mpr_print_evt_sas(struct mpr_softc *sc, MPI2_EVENT_NOTIFICATION_REPLY *event)
 		MPI2_EVENT_SAS_TOPOLOGY_CHANGE_LIST *data;
 		MPI2_EVENT_SAS_TOPO_PHY_ENTRY *phy;
 		int i, phynum;
+		int max_entries;
 
 		data = (MPI2_EVENT_DATA_SAS_TOPOLOGY_CHANGE_LIST *)
 		    &event->EventData;
+		/* never walk more PHY entries than the reply frame actually carries */
+		max_entries = (event->EventDataLength * 4 -
+		    offsetof(MPI2_EVENT_DATA_SAS_TOPOLOGY_CHANGE_LIST, PHY)) /
+		    sizeof(MPI2_EVENT_SAS_TOPO_PHY_ENTRY);
+		if (data->NumEntries > max_entries)
+			data->NumEntries = max_entries;
 		MPR_PRINTFIELD(sc, data, EnclosureHandle, 0x%x);
 		MPR_PRINTFIELD(sc, data, ExpanderDevHandle, 0x%x);
 		MPR_PRINTFIELD(sc, data, NumPhys, %d);