diff --git a/sys/dev/netif/iwn/if_iwn.c b/sys/dev/netif/iwn/if_iwn.c
--- a/sys/dev/netif/iwn/if_iwn.c
+++ b/sys/dev/netif/iwn/if_iwn.c
@@ -3362,6 +3362,15 @@
 		return;
 	}
 	len = (le32toh(desc->len) & 0x3fff) - 4;
+	/*
+	 * Bound len both ways. The masked desc->len comes from firmware /
+	 * DMA and is untrusted: len < 0 is a signed underflow that becomes
+	 * a huge kmalloc, and len larger than the RX mbuf minus the desc
+	 * header causes memcpy(buf, calib, len) below to read past the
+	 * 4 KiB mbuf cluster (OOB read / info leak / panic).
+	 */
+	if (len < 0 || len > (int)(IWN_RBUF_SIZE - sizeof(*desc)))
+		return;
 	bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD);
 
 	switch (calib->code) {