--- a/sys/dev/netif/iwn/if_iwn.c
+++ b/sys/dev/netif/iwn/if_iwn.c
@@ -8312,6 +8312,9 @@ iwn_read_firmware_tlv(struct iwn_softc *sc, struct iwn_fw_info *fw,
 			break;
 		case IWN_FW_TLV_PHY_CALIB:
+			/* Payload must hold the uint32_t we load below;
+			 * mirror the IWN_FW_TLV_FLAGS length checks. */
+			if (len < sizeof (uint32_t))
+				break;
 			tmp = le32toh(*ptr);
 			if (tmp < 253) {
 				sc->reset_noise_gain = tmp;