--- a/sys/bus/pccard/pccard_cis.c
+++ b/sys/bus/pccard/pccard_cis.c
@@ -409,6 +409,19 @@
 				goto done;
 			}
 
+			/* DF-2320: longlink_addr (:212) and mfc[].addr (:334)
+			 * are card-controlled 32-bit values, but the mapping is
+			 * only PCCARD_CIS_SIZE bytes; validate the target before
+			 * the first dereference below, using the same bound
+			 * formula as the inner walk (:164). */
+			if (tuple.mult * tuple.ptr >=
+			    PCCARD_CIS_SIZE - 1 - 32) {
+				device_printf(dev, "CIS link target 0x%lx out "
+				    "of range -- skipping\n",
+				    (u_long)tuple.ptr);
+				continue;
+			}
+
 			/* make sure that the link is valid */
 			tuple.code = pccard_cis_read_1(&tuple, tuple.ptr);
 			if (tuple.code != CISTPL_LINKTARGET) {