diff --git a/vm/devices/net/netvsp/src/lib.rs b/vm/devices/net/netvsp/src/lib.rs
index 0ec388ac37..cd1668bfb8 100644
--- a/vm/devices/net/netvsp/src/lib.rs
+++ b/vm/devices/net/netvsp/src/lib.rs
@@ -5392,12 +5392,23 @@ impl<T: 'static + RingMem> NetChannel<T> {
                 }
                 PacketData::SubChannelRequest(request) if state.primary.is_some() => {
                     let mut subchannel_count = 0;
+                    // The number of requested subchannels has to stay below the maximum queue limit
+                    // because one queue is always reserved for the primary channel. In other words,
+                    // the subchannels plus the primary channel must fit within the max_queues value,
+                    // which means subchannels + 1 ≤ max_queues, so the subchannel count must be
+                    // strictly less than max_queues.
                     let status = if request.operation == protocol::SubchannelOperation::ALLOCATE
-                        && request.num_sub_channels <= self.adapter.max_queues.into()
+                        && request.num_sub_channels < self.adapter.max_queues.into()
                     {
                         subchannel_count = request.num_sub_channels;
                         protocol::Status::SUCCESS
                     } else {
+                        tracelimit::warn_ratelimited!(
+                            operation = ?request.operation,
+                            request_sub_channels = request.num_sub_channels,
+                            max_supported_sub_channels = self.adapter.max_queues - 1,
+                            "Subchannel request failed: either operation is not supported or requested more subchannels than supported"
+                        );
                         protocol::Status::FAILURE
                     };