diff --git a/sys/netgraph7/bluetooth/drivers/bt3c/ng_bt3c_pccard.c b/sys/netgraph7/bluetooth/drivers/bt3c/ng_bt3c_pccard.c
--- a/sys/netgraph7/bluetooth/drivers/bt3c/ng_bt3c_pccard.c
+++ b/sys/netgraph7/bluetooth/drivers/bt3c/ng_bt3c_pccard.c
@@ -1129,6 +1129,8 @@
 				block->block_alignment);
 
 		bt3c_set_address(sc, block->block_address);
+		if (size + sizeof(*block) + block->block_size * 2 > firmware_size)
+			break;
 		for (i = 0; i < block->block_size; i++)
 			bt3c_write_data(sc, data[i]);