diff --git a/sys/dev/video/cxm/cxm_eeprom.c b/sys/dev/video/cxm/cxm_eeprom.c
@@ -142,10 +142,15 @@
 
 		for (i = 0; i < sizeof(eeprom); i += len) {
 			len = 0;
-			if (eeprom[i] == 0x84) {
-				len = (unsigned int)eeprom[i + 2] << 8
-				      | eeprom[i + 1];
-				i += 3;
+		if (eeprom[i] == 0x84) {
+			if (i + 2 >= sizeof(eeprom)) {
+				device_printf(sc->dev,
+				    "corrupt Hauppauge eeprom packet\n");
+				return -1;
+			}
+			len = (unsigned int)eeprom[i + 2] << 8
+			      | eeprom[i + 1];
+			i += 3;
 			} else if ((eeprom[i] & 0xf0) == 0x70) {
 				if (eeprom[i] & 0x08)
 					break;
@@ -167,11 +172,13 @@
 
 			switch (eeprom[i]) {
 			case 0x00:
-				tuner_code = eeprom[i + 6];
+				if (i + 6 < sizeof(eeprom))
+					tuner_code = eeprom[i + 6];
 				break;
 
 			case 0x0a:
-				tuner_code = eeprom[i + 2];
+				if (i + 2 < sizeof(eeprom))
+					tuner_code = eeprom[i + 2];
 				break;
 
 			default: