diff --git a/sys/bus/firewire/fwcrom.c b/sys/bus/firewire/fwcrom.c
--- a/sys/bus/firewire/fwcrom.c
+++ b/sys/bus/firewire/fwcrom.c
@@ -212,6 +212,14 @@
 	/* XXX should check spec and type */
 
 	bp = (u_int32_t *)&buf[0];
+	/* DF-1085: reject malformed text leaves whose claimed length is
+	 * smaller than the mandatory 2-word header, so the (crc_len - 2)
+	 * subtraction below cannot underflow into a negative qlen and
+	 * cause an OOB write at buf[qlen*4]. */
+	if (textleaf->crc_len < 2) {
+		strncpy(buf, nullstr, len);
+		return;
+	}
 	qlen = textleaf->crc_len - 2;
 	if (len < qlen * 4)
 		qlen = len/4;