diff --git a/sys/bus/firewire/fwcrom.c b/sys/bus/firewire/fwcrom.c
--- a/sys/bus/firewire/fwcrom.c
+++ b/sys/bus/firewire/fwcrom.c
@@ -204,7 +218,14 @@
 	}
 	textleaf = (struct csrtext *)(reg + reg->val);
 
-	if ((vm_offset_t)textleaf + textleaf->crc_len > CROM_END(cc)) {
+	/*
+	 * DF-1086: crc_len counts 32-bit quadlets, not bytes (the loop
+	 * below indexes text[i] as u_int32_t with qlen = crc_len-2), so
+	 * the bound must scale by sizeof(u_int32_t) and must cover the
+	 * whole leaf.
+	 */
+	if ((vm_offset_t)textleaf + (size_t)textleaf->crc_len * sizeof(u_int32_t)
+	    > CROM_END(cc)) {
 		strncpy(buf, nullstr, len);
 		return;
 	}