diff --git a/sys/netbt/hci_event.c b/sys/netbt/hci_event.c
--- a/sys/netbt/hci_event.c
+++ b/sys/netbt/hci_event.c
@@ -377,6 +377,15 @@
 	m_copydata(m, 0, sizeof(ep), &ep);
 	m_adj(m, sizeof(ep));
 
+	if (m->m_pkthdr.len < ep.num_con_handles *
+	    (sizeof(handle) + sizeof(num))) {
+		kprintf("%s: malformed Number_Of_Completed_Packets: "
+		    "claims %d handles but only %d bytes remain\n",
+		    device_get_nameunit(unit->hci_dev), ep.num_con_handles,
+		    m->m_pkthdr.len);
+		return;
+	}
+
 	while (ep.num_con_handles--) {
 		m_copydata(m, 0, sizeof(handle), &handle);
 		m_adj(m, sizeof(handle));