req->channel_min_dwell_time = cpu_to_le16(duration);
        req->channel_dwell_time = cpu_to_le16(duration);
 
-       req->channels_num = min_t(u8, sreq->n_channels, 32);
-       req->ext_channels_num = min_t(u8, ext_channels_num, 32);
+       if (sreq->n_channels == 0 || sreq->n_channels > 64) {
+               req->channel_type = 0;
+               req->channels_num = 0;
+               req->ext_channels_num = 0;
+       } else {
+               req->channel_type = 4;
+               req->channels_num = min_t(u8, sreq->n_channels, 32);
+               req->ext_channels_num = min_t(u8, ext_channels_num, 32);
+       }
+
        for (i = 0; i < req->channels_num + req->ext_channels_num; i++) {
                if (i >= 32)
                        chan = &req->ext_channels[i - 32];
                }
                chan->channel_num = scan_list[i]->hw_value;
        }
-       req->channel_type = sreq->n_channels ? 4 : 0;
 
        if (sreq->ie_len > 0) {
                memcpy(req->ies, sreq->ie, sreq->ie_len);