diff --git a/sys/bus/firewire/firewire.c b/sys/bus/firewire/firewire.c
--- a/sys/bus/firewire/firewire.c
+++ b/sys/bus/firewire/firewire.c
@@ -1497,6 +1497,15 @@
 			fc->ongodev->status = FWDEVATTACHED;
 			goto nextnode;
 		}
+		/*
+		 * Bounds-check ongoaddr BEFORE writing to csrrom[].
+		 * ongoaddr is a 16-bit bitfield that can wrap via
+		 * fc->ongoaddr += csrreg->val * 4 below; a malicious
+		 * device can craft val to make ongoaddr wrap past
+		 * CSRROMSIZE, causing an OOB write.
+		 */
+		if ((fc->ongoaddr - CSRROMOFF) >= CSRROMSIZE)
+			goto nextnode;
 		fc->ongodev->csrrom[(fc->ongoaddr - CSRROMOFF)/4] = ntohl(rfp->mode.rresq.data);
 		if(fc->ongoaddr > fc->ongodev->rommax){
 			fc->ongodev->rommax = fc->ongoaddr;