diff --git a/sys/bus/cam/scsi/scsi_cd.c b/sys/bus/cam/scsi/scsi_cd.c
--- a/sys/bus/cam/scsi/scsi_cd.c
+++ b/sys/bus/cam/scsi/scsi_cd.c
@@ -2949,6 +2949,16 @@
 	if (num_entries <= 0)
 		goto bailout;
 
+	/*
+	 * The TOC cache (softc->toc) only has room for 100 entries + leadout
+	 * (see struct cd_tocdata).  A malicious or buggy device can advertise
+	 * ending_track/starting_track pairs that yield far more (up to 257),
+	 * which would overflow the cache on the subsequent READ TOC and the
+	 * fixup/conversion loops below.  Reject anything that does not fit.
+	 */
+	if (num_entries > (int)nitems(softc->toc.entries))
+		goto bailout;
+
 	toclen = num_entries * sizeof(struct cd_toc_entry);
 
 	error = cdreadtoc(periph, CD_MSF_FORMAT, toch->starting_track,