diff --git a/sys/dev/acpica/acpi_hp/acpi_hp.c b/sys/dev/acpica/acpi_hp/acpi_hp.c
--- a/sys/dev/acpica/acpi_hp/acpi_hp.c
+++ b/sys/dev/acpica/acpi_hp/acpi_hp.c
@@ -845,7 +845,8 @@
 		return (-EINVAL);
 	}
 	obj = out.Pointer;
-	if (!obj || obj->Type != ACPI_TYPE_BUFFER) {
+	if (!obj || obj->Type != ACPI_TYPE_BUFFER ||
+	    obj->Buffer.Length < 3 * sizeof(UINT32)) {
 		acpi_hp_free_buffer(&out);
 		return (-EINVAL);
 	}