diff --git a/sys/dev/pccard/cardbus/cardbus_cis.c b/sys/dev/pccard/cardbus/cardbus_cis.c
--- a/sys/dev/pccard/cardbus/cardbus_cis.c
+++ b/sys/dev/pccard/cardbus/cardbus_cis.c
@@ -652,6 +652,7 @@
 	uint32_t start, off;
 	struct resource *res;
 	int rid;
+	int cis_iter = 0, cis_max = 4096;
 
 	bzero(tupledata, MAXTUPLESIZE);
 	expect_linktarget = TRUE;
@@ -668,6 +669,11 @@
 	}
 
 	do {
+		if (++cis_iter > cis_max) {
+			device_printf(cbdev, "CIS chain too long, aborting\n");
+			cardbus_read_tuple_finish(cbdev, child, rid, res);
+			return (ENXIO);
+		}
 		if (0 != cardbus_read_tuple(cbdev, child, res, start, &off,
 		    &tupleid, &len, tupledata)) {
 			device_printf(cbdev, "Failed to read CIS.\n");