--- a/sys/gnu/dev/misc/apple_gmux/apple-gmux.c
+++ b/sys/gnu/dev/misc/apple_gmux/apple-gmux.c
@@ -744,6 +754,17 @@
 	}
 
 	/*
+	 * bus_space port access is not bounds-checked; refuse to attach if
+	 * the ACPI _CRS window is smaller than the registers we touch.
+	 */
+	if (rman_get_size(sc->io_res) < GMUX_MIN_IO_LEN) {
+		pr_err("gmux I/O region too small (%ju bytes, need >= %d)\n",
+		    (uintmax_t)rman_get_size(sc->io_res), GMUX_MIN_IO_LEN);
+		ret = -ENODEV;
+		goto err_release;
+	}
+
+	/*
 	 * Explicitly initialize sc->indexed, to be clear we assume
 	 * gmux is classic by default.
 	 */
@@ -759,6 +780,11 @@
 	ver_minor = gmux_read8(sc, GMUX_PORT_VERSION_MINOR);
 	ver_release = gmux_read8(sc, GMUX_PORT_VERSION_RELEASE);
 	if (ver_major == 0xff && ver_minor == 0xff && ver_release == 0xff) {
+		if (rman_get_size(sc->io_res) < GMUX_PORT_WRITE + 4) {
+			pr_err("gmux I/O region too small for indexed probe\n");
+			ret = -ENODEV;
+			goto err_release;
+		}
 		if (gmux_is_indexed(sc)) {
 			u32 version;
 			lockinit(&sc->lk, "apple_gmux", 0, 0);