diff --git a/sys/dev/misc/ipmi/ipmi_ssif.c b/sys/dev/misc/ipmi/ipmi_ssif.c
index e4f0558..fc4973d 100644
@@ -203,6 +203,18 @@
 #endif
 
 	/*
+	 * The byte count returned by the BMC is untrusted and, on some SMBus
+	 * backends, is the raw hardware byte count which is NOT clamped to
+	 * SMBUS_DATA_SIZE.  Reject anything that would not fit in our fixed
+	 * ssif_buf[] so that subsequent indexing cannot read past the buffer.
+	 */
+	if (count > SMBUS_DATA_SIZE) {
+		device_printf(dev, "SSIF: Oversized reply packet (%d bytes)\n",
+		    count);
+		goto fail;
+	}
+
+	/*
 	 * If this is the first part of a multi-part read, then we need to
 	 * skip the first two bytes.
 	 */
@@ -270,6 +282,12 @@
 		device_printf(dev, "SSIF: READ_CONT... ok\n");
 #endif
 
+		if (count > SMBUS_DATA_SIZE) {
+			device_printf(dev,
+			    "SSIF: Oversized read block (%d bytes)\n", count);
+			goto fail;
+		}
+
 		/* Verify the block number.  0xff marks the last block. */
 		if (ssif_buf[0] != 0xff && ssif_buf[0] != block) {
 			device_printf(dev, "SSIF: Read wrong block %d %d\n",