diff --git a/sys/bus/firewire/fwdev.c b/sys/bus/firewire/fwdev.c
--- a/sys/bus/firewire/fwdev.c
+++ b/sys/bus/firewire/fwdev.c
@@ -388,6 +388,13 @@
 	fp = (struct fw_pkt *)fwdma_v_addr(it->buf,
 			it->stproc->poffset + it->queued);
 	err = uiomove((caddr_t)fp, sizeof(struct fw_isohdr), uio);
+	/*
+	 * Clamp the stream payload length to the slot's usable size.
+	 * fp->mode.stream.len is user-controlled (16-bit) and was not
+	 * validated against the per-packet DMA slot size (it->psize).
+	 */
+	if (fp->mode.stream.len > it->psize - sizeof(struct fw_isohdr))
+		fp->mode.stream.len = it->psize - sizeof(struct fw_isohdr);
 	err = uiomove((caddr_t)fp->mode.stream.payload,
 				fp->mode.stream.len, uio);
 	it->queued ++;