diff --git a/sys/bus/smbus/ichsmb/ichsmb.c b/sys/bus/smbus/ichsmb/ichsmb.c
--- a/sys/bus/smbus/ichsmb/ichsmb.c
+++ b/sys/bus/smbus/ichsmb/ichsmb.c
@@ -574,6 +574,11 @@
 				if (sc->block_index == 0) {
 					sc->block_count = bus_read_1(
 					    sc->io_res, ICH_D0);
+					/* D0 is slave-supplied and unbounded; cap it to the
+					   block_data[32] array or the store loop runs off the
+					   end of the softc (heap overflow). */
+					if (sc->block_count > nitems(sc->block_data))
+						sc->block_count = nitems(sc->block_data);
 				}
 
 				/* Get next byte, if any */