diff --git a/src/ipc/ipc4/handler-user.c b/src/ipc/ipc4/handler-user.c
index 8aee53d382b3..225af13abe6c 100644
--- a/src/ipc/ipc4/handler-user.c
+++ b/src/ipc/ipc4/handler-user.c
@@ -1582,7 +1582,7 @@ __cold int ipc4_user_process_module_message(struct ipc4_message_request *ipc4,
 							mi->primary.r.instance_id);
 			const struct comp_driver *drv = ipc4_get_comp_drv(IPC4_MOD_ID(comp_id));
 
-			if (!drv) {
+			if (!drv || !drv->ops.create) {
 				ret = IPC4_MOD_NOT_INITIALIZED;
 				break;
 			}
diff --git a/src/ipc/ipc4/helper.c b/src/ipc/ipc4/helper.c
index 18bc4904464c..c135f43a4e97 100644
--- a/src/ipc/ipc4/helper.c
+++ b/src/ipc/ipc4/helper.c
@@ -201,6 +201,12 @@ __cold struct comp_dev *comp_new_ipc4(const struct ipc4_module_init_instance *mo
 	if (!drv)
 		return NULL;
 
+	if (!drv->ops.create) {
+		tr_err(&ipc_tr, "comp 0x%x: module %u is not instantiable", comp_id,
+		       (uint32_t)IPC4_MOD_ID(comp_id));
+		return NULL;
+	}
+
 	if (drv->type == SOF_COMP_MODULE_ADAPTER) {
 		const struct ipc_config_process spec = {
 			.data = data,
@@ -1361,19 +1367,16 @@ __cold static const struct comp_driver *ipc4_get_drv(const void *uuid)
  * 1-based index into the runtime component driver list, counting only
  * instantiable module-adapter drivers so the fuzzer's module_id space matches
  * what a real signed manifest would expose.
- *
- * module_id 0 (BaseFW) is deliberately not mapped: BaseFW is never created as
- * a pipeline component - its messages are dispatched directly by base_fw.c -
- * so returning NULL for it here is correct.
  */
 static const struct comp_driver *ipc4_get_fuzzer_drv(uint32_t module_id)
 {
+	static const struct sof_uuid basefw_reg_uuid = SOF_REG_UUID(basefw);
 	struct comp_driver_list *dlist = comp_drivers_get();
 	struct list_item *iter;
 	uint32_t idx = 0;
 
 	if (!module_id)
-		return NULL;
+		return ipc4_search_for_drv(&basefw_reg_uuid);
 
 	list_for_item(iter, &dlist->list) {
 		struct comp_driver_info *inf =