diff --git a/sys/bus/smbus/smbacpi/smbacpi.c b/sys/bus/smbus/smbacpi/smbacpi.c
--- a/sys/bus/smbus/smbacpi/smbacpi.c
+++ b/sys/bus/smbus/smbacpi/smbacpi.c
@@ -205,6 +205,10 @@
 				memcpy(gsb->data, buf, count);
 			}
 		} else {
+			if (gsb->len > sizeof(buf)) {
+				s = AE_AML_NUMERIC_OVERFLOW;
+				goto err;
+			}
 			memcpy(buf, gsb->data, gsb->len);
 			count = gsb->len;
 			val = SMBUS_BWRITE(dev, sb->SlaveAddress, Address,
@@ -220,6 +224,10 @@
 			if (val == 0)
 				memcpy(gsb->data, buf, cnt);
 		} else {
+			if (info->AccessLength > sizeof(buf)) {
+				s = AE_AML_NUMERIC_OVERFLOW;
+				goto err;
+			}
 			memcpy(buf, gsb->data, info->AccessLength);
 			val = SMBUS_TRANS(dev, sb->SlaveAddress, Address,
 			    SMB_TRANS_NOCNT | SMB_TRANS_7BIT,