diff --git a/sys/bus/u4b/uvc/uvc_drv.c b/sys/bus/u4b/uvc/uvc_drv.c
--- a/sys/bus/u4b/uvc/uvc_drv.c
+++ b/sys/bus/u4b/uvc/uvc_drv.c
@@ -1914,6 +1914,10 @@
 					frm->width * frm->height / 8;
 			frm->interval_type = frmd->bFrameIntervalType;
 			frm->interval = itv;
+			/* dFrameInterval[0] at offset 26, 4 bytes each; bound to bLength
+			   since usb_desc_foreach only checks desc+bLength<=end. */
+			if (frmd->bLength >= 26 && frm->interval_type > (frmd->bLength - 26) / 4)
+				frm->interval_type = (frmd->bLength - 26) / 4;
 			for (i = 0; i < frm->interval_type; i++) {
 				interval = UGETDW(frmd->dFrameInterval[i]);
 				itv->val = interval ? interval : 1;
@@ -1945,6 +1949,9 @@
 					frm->width * frm->height / 8;
 			frm->interval_type = fbrmd->bFrameIntervalType;
 			frm->interval = itv;
+			/* frame_based: dFrameInterval[0] at offset 27. */
+			if (fbrmd->bLength >= 27 && frm->interval_type > (fbrmd->bLength - 27) / 4)
+				frm->interval_type = (fbrmd->bLength - 27) / 4;
 			for (i = 0; i < frm->interval_type; i++) {
 				interval = UGETDW(fbrmd->dFrameInterval[i]);
 				itv->val = interval ? interval : 1;