Index: sys/dev/ntb/ntb_hw/ntb_hw.c
===================================================================
--- sys/dev/ntb/ntb_hw/ntb_hw.c
+++ sys/dev/ntb/ntb_hw/ntb_hw.c
@@ -1067,10 +1067,18 @@
 		ntb->db_vec_shift = XEON_DB_TOTAL_SHIFT;
 		rc = ntb_setup_legacy_interrupt(ntb);
 	} else {
+		if (num_vectors - 1 != XEON_NONLINK_DB_MSIX_BITS &&
+		    HAS_FEATURE(NTB_SB01BASE_LOCKUP)) {
+			device_printf(ntb->device,
+			    "Errata workaround expects %d doorbell bits\n",
+			    XEON_NONLINK_DB_MSIX_BITS);
+			return (EINVAL);
+		}
+
 		ntb_create_msix_vec(ntb, num_vectors);
 		rc = ntb_setup_msix(ntb, num_vectors);
 		if (rc == 0 && HAS_FEATURE(NTB_SB01BASE_LOCKUP))
-			ntb_get_msix_info(ntb, num_vectors);
+			ntb_get_msix_info(ntb, XEON_NONLINK_DB_MSIX_BITS);
 	}
 	if (rc != 0) {
 		device_printf(ntb->device,
@@ -1341,6 +1349,10 @@
 	struct pcicfg_msix *msix;
 	uint32_t laddr, data, i, offset;
 
+	KASSERT(num_vectors == nitems(ntb->msix_data),
+	    ("%s: only the first three vectors are used for doorbells (not %u)",
+	     __func__, (unsigned)num_vectors));
+
 	dinfo = device_get_ivars(ntb->device);
 	msix = &dinfo->cfg.msix;