diff --git a/sys/bus/firewire/fwcrom.c b/sys/bus/firewire/fwcrom.c
--- a/sys/bus/firewire/fwcrom.c
+++ b/sys/bus/firewire/fwcrom.c
@@ -81,6 +81,20 @@
 		/* minimum ROM */
 		cc->depth = -1;
 	}
+	/*
+	 * DF-1084: info_len is attacker-controlled (device-supplied
+	 * ConfigROM) and is used to advance the data pointer past the
+	 * bus-info block.  Bound it so the root-directory pointer stays
+	 * within the 1024-byte (256-quad) csrrom buffer (the header is
+	 * quad 0, the bus-info block is quads 1..info_len, so the root
+	 * directory at quad 1+info_len needs 1+info_len <= 255).
+	 */
+	if (hdr->info_len > 254) {
+		kprintf("crom_init_context: info_len %d too large\n",
+			hdr->info_len);
+		cc->depth = -1;
+		return;
+	}
 	p += 1 + hdr->info_len;
 
 	/* check size of root directory */