--- a/sys/dev/netif/iwm/if_iwm.c	2026-09-15 10:51:39.216775004 +0000
+++ b/sys/dev/netif/iwm/if_iwm.c	2026-09-15 10:51:59.596513305 +0000
@@ -2782,6 +2782,11 @@
 		lmac2 = &palive->lmac_data[1];
 		status = le16toh(palive->status);
 	} else {
+		if (iwm_rx_packet_payload_len(pkt) < sizeof(*palive3)) {
+			device_printf(sc->sc_dev,
+			    "%s: truncated ALIVE notification\n", __func__);
+			return FALSE;
+		}
 		palive3 = (void *)pkt->data;
 		umac = &palive3->umac_data;
 		lmac1 = &palive3->lmac_data;
@@ -5509,8 +5514,10 @@
 		case IWM_NVM_ACCESS_CMD:
 		case IWM_MCC_UPDATE_CMD:
 			if (sc->sc_wantresp == (((qid & ~0x80) << 16) | idx)) {
-				memcpy(sc->sc_cmd_resp,
-				    pkt, sizeof(sc->sc_cmd_resp));
+				size_t clen = len;	/* actual packet bytes */
+				if (clen > sizeof(sc->sc_cmd_resp))
+					clen = sizeof(sc->sc_cmd_resp);
+				memcpy(sc->sc_cmd_resp, pkt, clen);
 			}
 			break;