diff --git a/sys/bus/firewire/fwdev.c b/sys/bus/firewire/fwdev.c
--- a/sys/bus/firewire/fwdev.c
+++ b/sys/bus/firewire/fwdev.c
@@ -575,6 +575,12 @@
 
 		/* copy response */
 		tinfo = &sc->fc->tcode[xfer->recv.hdr.mode.hdr.tcode];
+		/* Bound the response copy by the real destination capacity
+		 * (the fixed-size data[512] array), not user-supplied req.len. */
+		if (xfer->recv.pay_len > sizeof(asyreq->data)) {
+			err = EINVAL;
+			goto out;
+		}
 		if (asyreq->req.len >= xfer->recv.pay_len + tinfo->hdr_len)
 			asyreq->req.len = xfer->recv.pay_len;
 		else