--- a/sys/bus/u4b/audio/uaudio.c
+++ b/sys/bus/u4b/audio/uaudio.c
@@ -3985,6 +3985,8 @@
 
 		d1 = (const void *)(u.mu->baSourceId + u.mu->bNrInPins);
 
+		if (u.desc->bLength < len + 1)
+			goto error;	/* d1->bNrChannels past body */
 		len += sizeof(*d1) + d1->bNrChannels;
 		break;