diff --git a/sys/bus/u4b/wlan/if_urtwn.c b/sys/bus/u4b/wlan/if_urtwn.c
--- a/sys/bus/u4b/wlan/if_urtwn.c
+++ b/sys/bus/u4b/wlan/if_urtwn.c
@@ -1831,6 +1831,16 @@
 			off = reg >> 4;
 		msk = reg & 0xf;
 
+		/* DF-0983: off is fully device-controlled (crafted extended-header
+		 * bytes can set it up to 127).  urtwn_efuse_read_data() writes
+		 * rom[off*8 .. off*8+7]; reject any offset that would write past
+		 * the (at most URTWN_EFUSE_MAX_LEN-sized) rom buffer. */
+		if ((uint32_t)off * 8 + 7 >= size) {
+			device_printf(sc->sc_dev, "%s: bad efuse offset %u\n",
+			    __func__, off);
+			goto end;
+		}
+
 		URTWN_CHK(urtwn_efuse_read_data(sc, rom, off, msk));
 		URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
 	}