diff --git a/sys/amd64/include/xen/hypercall.h b/sys/amd64/include/xen/hypercall.h
index 6d00d4a6ebd8..60da390ef4c6 100644
--- a/sys/amd64/include/xen/hypercall.h
+++ b/sys/amd64/include/xen/hypercall.h
@@ -145,6 +145,9 @@ privcmd_hypercall(long op, long a1, long a2, long a3, long a4, long a5)
 	register long __arg5 __asm__("r8") = (long)(a5);
 	long __call = (long)&hypercall_page + (op * 32);
 
+	if (op >= PAGE_SIZE / 32)
+		return -EINVAL;
+
 	__asm__ volatile (
 		"call *%[call]"
 		: "=a" (__res), "=D" (__ign1), "=S" (__ign2),
diff --git a/sys/i386/include/xen/hypercall.h b/sys/i386/include/xen/hypercall.h
index 4002aac58d84..f1757e8becaf 100644
--- a/sys/i386/include/xen/hypercall.h
+++ b/sys/i386/include/xen/hypercall.h
@@ -122,6 +122,9 @@ privcmd_hypercall(long op, long a1, long a2, long a3, long a4, long a5)
 {
 	long __res, __ign1, __ign2, __ign3, __ign4, __ign5, __call;
 
+	if (op >= PAGE_SIZE / 32)
+		return -EINVAL;
+
 	__call = (long)&hypercall_page + (op * 32);
 	__asm__ volatile (
 		"call *%[call]"