1 files changed, 14 insertions, 3 deletions

diff --git a/sys/dev/iwm/if_iwm.c b/sys/dev/iwm/if_iwm.c
index 510491e4d61f..d325d647d3e6 100644
--- a/sys/dev/iwm/if_iwm.c
+++ b/sys/dev/iwm/if_iwm.c
@@ -3373,6 +3373,11 @@ iwm_setrates(struct iwm_softc *sc, struct iwm_node *in)
 		    "only %zu\n", __func__, nrates, nitems(lq->rs_table));
 		return;
 	}
+	if (nrates == 0) {
+		device_printf(sc->sc_dev,
+		    "%s: node supports 0 rates, odd!\n", __func__);
+		return;
+	}
 
 	/*
 	 * XXX .. and most of iwm_node is not initialised explicitly;
@@ -3384,8 +3389,14 @@ iwm_setrates(struct iwm_softc *sc, struct iwm_node *in)
 	memset(&in->in_ridx, -1, sizeof(in->in_ridx));
 	IWM_DPRINTF(sc, IWM_DEBUG_TXRATE,
 	    "%s: nrates=%d\n", __func__, nrates);
-	for (i = 0; i < nrates; i++) {
-		int rate = ni->ni_rates.rs_rates[i] & IEEE80211_RATE_VAL;
+
+	/*
+	 * Loop over nrates and populate in_ridx from the highest
+	 * rate to the lowest rate.  Remember, in_ridx[] has
+	 * IEEE80211_RATE_MAXSIZE entries!
+	 */
+	for (i = 0; i < min(nrates, IEEE80211_RATE_MAXSIZE); i++) {
+		int rate = ni->ni_rates.rs_rates[(nrates - 1) - i] & IEEE80211_RATE_VAL;
 
 		/* Map 802.11 rate to HW rate index. */
 		for (ridx = 0; ridx <= IWM_RIDX_MAX; ridx++)
@@ -3442,7 +3453,7 @@ iwm_setrates(struct iwm_softc *sc, struct iwm_node *in)
 		 * our hardware table containing the
 		 * configuration to use for this rate.
 		 */
-		ridx = in->in_ridx[(nrates-1)-i];
+		ridx = in->in_ridx[i];
 		tab = iwm_rates[ridx].plcp;
 		tab |= nextant << IWM_RATE_MCS_ANT_POS;
 		if (IWM_RIDX_IS_CCK(ridx))