diff --git a/sys/dev/misc/ipmi/ipmi_kcs.c b/sys/dev/misc/ipmi/ipmi_kcs.c
--- a/sys/dev/misc/ipmi/ipmi_kcs.c
+++ b/sys/dev/misc/ipmi/ipmi_kcs.c
@@ -408,7 +408,7 @@
 
 	/* Finally, read the reply from the BMC. */
 	i = 0;
-	for (;;) {
+	for (i = 0; i < req->ir_replybuflen + 64; i++) {
 		state = kcs_read_byte(sc, &data);
 		if (state == 0) {
 			device_printf(sc->ipmi_dev,
@@ -416,6 +416,8 @@
 			goto fail;
 		}
 		if (state == 2)
+			break;
+		if (i >= req->ir_replybuflen + 63)
 			break;
 		if (i < req->ir_replybuflen) {
 			req->ir_reply[i] = data;