diff --git a/sys/bus/u4b/wlan/if_urtwn.c b/sys/bus/u4b/wlan/if_urtwn.c
--- a/sys/bus/u4b/wlan/if_urtwn.c
+++ b/sys/bus/u4b/wlan/if_urtwn.c
@@ -1759,6 +1759,13 @@
 	uint8_t reg;
 	int i, error;
 
+	/* off indexes 8-byte eFUSE words; the ROM image is URTWN_EFUSE_MAX_LEN
+	 * (512) bytes. A malicious device can synthesize off in [0,127] via the
+	 * extended-header branch, which would write past sc->rom into adjacent
+	 * softc fields (callouts, lock). Reject out-of-range offsets. */
+	if (off >= URTWN_EFUSE_MAX_LEN / 8)
+		return (0);
+
 	for (i = 0; i < 4; i++) {
 		if (msk & (1 << i))
 			continue;