--- a/sys/bus/u4b/controller/ehci_pci.c
+++ b/sys/bus/u4b/controller/ehci_pci.c
@@ -510,12 +510,15 @@
 	uint16_t to;
 	uint8_t eecp;
 	uint8_t bios_sem;
+	uint16_t ncap;
 
 	cparams = EREAD4(sc, EHCI_HCCPARAMS);
 
 	/* Synchronise with the BIOS if it owns the controller. */
-	for (eecp = EHCI_HCC_EECP(cparams); eecp != 0;
+	for (ncap = 0, eecp = EHCI_HCC_EECP(cparams); eecp != 0;
 	    eecp = EHCI_EECP_NEXT(eec)) {
+		if (eecp < 0x40 || ++ncap > 255)
+			break;	/* past config header / cyclic list */
 		eec = pci_read_config(self, eecp, 4);
 		if (EHCI_EECP_ID(eec) != EHCI_EC_LEGSUP) {
 			continue;