diff --git a/sys/netproto/smb/smb_rq.c b/sys/netproto/smb/smb_rq.c
--- a/sys/netproto/smb/smb_rq.c
+++ b/sys/netproto/smb/smb_rq.c
@@ -433,6 +433,11 @@
 	for(len = 0, m = m0; m->m_next; m = m->m_next)
 		len += m->m_len;
 	len += m->m_len;
+	if (count > (u_int16_t)len) {
+		/* server claimed more bytes than the response actually carries */
+		m_freem(m0);
+		return EBADRPC;
+	}
 	m->m_len -= len - count;
 	if (mdp->md_top == NULL) {
 		md_initm(mdp, m0);