--- a/sys/dev/netif/ath/ath_hal/ar5312/ar5312_attach.c
+++ b/sys/dev/netif/ath/ath_hal/ar5312/ar5312_attach.c
@@ -283,11 +283,19 @@ ar5312Attach(uint16_t devid, HAL_SOFTC sc,
 static HAL_BOOL
 ar5312GetMacAddr(struct ath_hal *ah)
 {
-	const struct ar531x_boarddata *board = AR5312_BOARDCONFIG(ah); 
-        int wlanNum = AR5312_UNIT(ah);
+	const struct ar531x_config *config =
+	    (const struct ar531x_config *) ah->ah_st;
+	const struct ar531x_boarddata *board;
+        int wlanNum;
         const uint8_t *macAddr;
 
+	/*
+	 * The BSP is required to pass an ar531x_config as the bus tag
+	 * (ah_soc.h), but never trust it: validate before dereferencing.
+	 */
+	if (config == AH_NULL || (board = config->board) == AH_NULL ||
+	    board->magic != AR531X_BD_MAGIC)
+		return AH_FALSE;
+	wlanNum = config->unit;
+
         switch (wlanNum) {
 	case 0:
 		macAddr = board->wlan0Mac;