diff --git a/sys/dev/misc/ipmi/ipmi_ssif.c b/sys/dev/misc/ipmi/ipmi_ssif.c
index e4f0558..7afc848 100644
@@ -53,6 +53,7 @@
 #define SMBUS_READ_START	0x03
 #define SMBUS_READ_CONT		0x09
 #define SMBUS_DATA_SIZE		32
+#define SSIF_MAX_READ_BLOCKS	256	/* bound multi-part response read */
 
 #ifdef SSIF_DEBUG
 static void
@@ -75,7 +76,7 @@
 	device_t smbus = sc->ipmi_ssif_smbus;
 	u_char *cp, block, count, offset;
 	size_t len;
-	int error;
+	int error, readblocks;
 
 	/* Acquire the bus while we send the request. */
 	if (smbus_request_bus(smbus, dev, SMB_WAIT) != 0)
@@ -253,8 +254,13 @@
 	bcopy(&ssif_buf[5], req->ir_reply, min(req->ir_replybuflen, count - 5));
 	len = count - 5;
 	block = 1;
+	readblocks = 0;
 
 	for (;;) {
+		if (++readblocks > SSIF_MAX_READ_BLOCKS) {
+			device_printf(dev, "SSIF: too many read blocks\n");
+			goto fail;
+		}
 		/* Read another packet via READ_CONT. */
 		count = SMBUS_DATA_SIZE;
 		error = smbus_error(smbus_bread(smbus,