--- a/sys/bus/pccard/pccard_cis.c
+++ b/sys/bus/pccard/pccard_cis.c
@@ -992,6 +992,8 @@
 						/* if the bit is set */
 						if ((reg >> j) & 0x01) {
 							/* skip over bytes */
+							if (tuple->length <= idx)
+								goto abort_cfe;
 							do {
 								reg2 = pccard_tuple_read_1(tuple, idx);
 								idx++;