diff --git a/sys/net/ppp_layer/slcompress.c b/sys/net/ppp_layer/slcompress.c
--- a/sys/net/ppp_layer/slcompress.c
+++ b/sys/net/ppp_layer/slcompress.c
@@ -74,6 +74,11 @@
 		bzero((char *)comp->tstate, sizeof(comp->tstate));
 		bzero((char *)comp->rstate, sizeof(comp->rstate));
 	}
+	/* Clamp to the valid tstate[] index range. Callers such as sppp pass a
+	 * raw byte from a remote IPCP Configure-Request (max_state 0..255);
+	 * any value > MAX_STATES-1 overflows comp->tstate[] in the loop below. */
+	if (max_state < 0 || max_state > MAX_STATES - 1)
+		max_state = MAX_STATES - 1;
   	for (i = max_state; i > 0; --i) {
 		tstate[i].cs_id = i;
 		tstate[i].cs_next = &tstate[i - 1];