Hi,

can you try the diff below?

Take care,
HJ.

-------------------------------------------
commit 06db3b068fe7c3a94258b626bfc6f2d690834b17
Author: hshoexer <hshoexer@yerbouti.franken.de>
Date:   Thu Jun 18 17:59:30 2026 +0200

    SEV: Only use sane MinSevNoEsAsid values
    
    MinSevNoEsAsid may not be larger than NumEncryptedGuests.

diff --git a/sys/arch/amd64/amd64/identcpu.c b/sys/arch/amd64/amd64/identcpu.c
index 51e8344d573..43c61c2b09f 100644
--- a/sys/arch/amd64/amd64/identcpu.c
+++ b/sys/arch/amd64/amd64/identcpu.c
@@ -711,7 +711,11 @@ identifycpu(struct cpu_info *ci)
 		    'd', CPUID_MEMBER(ci_feature_amdsev_edx),
 		    CPUID_AMDSEV_EDX_BITS);
 		amd64_pos_cbit = (ci->ci_feature_amdsev_ebx & 0x3f);
-		amd64_min_noes_asid = ci->ci_feature_amdsev_edx;
+
+		/* MinSevNoEsAsid may not exceed NumEncryptedGuests */
+		if (ci->ci_feature_amdsev_edx <= ci->ci_feature_amdsev_ecx)
+			amd64_min_noes_asid = ci->ci_feature_amdsev_edx;
+
 		if (cpu_sev_guestmode && CPU_IS_PRIMARY(ci))
 			printf("\n%s: SEV%s guest mode", ci->ci_dev->dv_xname,
 			    ISSET(cpu_sev_guestmode, SEV_STAT_ES_ENABLED) ?