--- a/sys/dev/netif/iwm/if_iwm.c	2026-09-15 10:51:39.216775004 +0000
+++ b/sys/dev/netif/iwm/if_iwm.c	2026-09-15 10:51:59.600513253 +0000
@@ -603,6 +603,13 @@
 	 * Parse firmware contents
 	 */
 
+	if (fw->fw_fp->datasize < sizeof(struct iwm_tlv_ucode_header)) {
+		device_printf(sc->sc_dev, "invalid firmware %s\n",
+		    sc->cfg->fw_name);
+		error = EINVAL;
+		goto out;
+	}
+
 	uhdr = (const void *)fw->fw_fp->data;
 	if (*(const uint32_t *)fw->fw_fp->data != 0
 	    || le32toh(uhdr->magic) != IWM_TLV_UCODE_MAGIC) {
@@ -627,7 +634,7 @@
 		tlv_type = le32toh(tlv->type);
 		tlv_data = tlv->data;
 
-		if (len < tlv_len) {
+		if (len < roundup2(tlv_len, 4)) {
 			device_printf(sc->sc_dev,
 			    "firmware too short: %zu bytes\n",
 			    len);