diff --git a/sys/bus/smbus/smbacpi/smbacpi.c b/sys/bus/smbus/smbacpi/smbacpi.c
--- a/sys/bus/smbus/smbacpi/smbacpi.c
+++ b/sys/bus/smbus/smbacpi/smbacpi.c
@@ -134,7 +134,16 @@
 	uint16_t *wdata;
 	short word;
 	char byte;
-	char buf[32];
+	/*
+	 * ACPICA allocates 257-byte buffers (2-byte header +
+	 * ACPI_MAX_GSBUS_DATA_SIZE = 255 data bytes) for ATTRIB_BLOCK(0x0A)
+	 * and ATTRIB_BYTES(0x0B) GSBUS transfers and hands the data portion
+	 * to this handler.  The buffer must be large enough to hold the
+	 * largest possible data payload, otherwise the memcpy/memset at
+	 * :208/:223 and the SMBUS_TRANS rbuf=:217-219 will overflow the
+	 * stack.
+	 */
+	char buf[ACPI_MAX_GSBUS_DATA_SIZE + 1];
 	u_char count;
 
 	if (Value == NULL)