diff --git a/sys/netbt/hci_event.c b/sys/netbt/hci_event.c
--- a/sys/netbt/hci_event.c
+++ b/sys/netbt/hci_event.c
@@ -309,8 +309,15 @@
 	 * I am not sure if this is completely correct, it is not guaranteed
 	 * that a command_complete packet will contain the status though most
 	 * do seem to.
+	 *
+	 * Garbage in the status byte is preferable to reading past the
+	 * end of the mbuf chain, so only fetch it when the mbuf has at
+	 * least sizeof(rp) bytes left after stripping the ep header.
+	 * Otherwise leave rp.status = 0 (success) and skip the warning.
 	 */
-	m_copydata(m, 0, sizeof(rp), &rp);
+	memset(&rp, 0, sizeof(rp));
+	if (m->m_pkthdr.len >= sizeof(rp))
+		m_copydata(m, 0, sizeof(rp), &rp);
 	if (rp.status > 0)
 		kprintf("%s: CommandComplete opcode (%03x|%04x) failed (status=0x%02x)\n",
 		    device_get_nameunit(unit->hci_dev), HCI_OGF(letoh16(ep.opcode)),