--- a/sys/dev/misc/orm/orm.c
+++ b/sys/dev/misc/orm/orm.c
@@ -102,6 +102,14 @@ orm_identify(driver_t* driver, device_t
 	sc = device_get_softc(child);
 	sc->rnum = 0;
 	while (chunk < IOMEM_END) {
+		/*
+		 * sc->rid[] / sc->res[] hold MAX_ROMS entries.  The ISA bus
+		 * layer currently refuses SYS_RES_MEMORY rids >= ISA_NMEM(8),
+		 * which keeps rnum below MAX_ROMS, but do not rely on that
+		 * coupling: bound the loop explicitly.
+		 */
+		if (sc->rnum >= MAX_ROMS)
+			break;
 		bus_set_resource(child, SYS_RES_MEMORY, sc->rnum, chunk,
 		    IOMEM_STEP, -1);
 		rid = sc->rnum;
@@ -134,6 +142,9 @@ orm_identify(driver_t* driver, device_t
 			continue;
 		}
 		rom_size = buf[2] << 9;
+		/* keep the reserved range inside the ISA memory hole */
+		if (chunk + rom_size > IOMEM_END)
+			rom_size = IOMEM_END - chunk;
 		bus_set_resource(child, SYS_RES_MEMORY, sc->rnum, chunk,
 		    rom_size, -1);
 		rid = sc->rnum;