--- a/sys/dev/netif/ix/ixgbe_common.c
+++ b/sys/dev/netif/ix/ixgbe_common.c
@@ -2239,6 +2247,11 @@
 		if (pointer == 0xFFFF || pointer == 0)
 			continue;
 
+		if (pointer >= hw->eeprom.word_size) {
+			DEBUGOUT("EEPROM pointer outside word range\n");
+			return IXGBE_ERR_EEPROM;
+		}
+
 		if (hw->eeprom.ops.read(hw, pointer, &length)) {
 			DEBUGOUT("EEPROM read failed\n");
 			return IXGBE_ERR_EEPROM;
@@ -2247,6 +2260,11 @@
 		if (length == 0xFFFF || length == 0)
 			continue;
 
+		if (length >= hw->eeprom.word_size - pointer) {
+			DEBUGOUT("EEPROM section outside word range\n");
+			return IXGBE_ERR_EEPROM;
+		}
+
 		for (j = pointer + 1; j <= pointer + length; j++) {
 			if (hw->eeprom.ops.read(hw, j, &word)) {
 				DEBUGOUT("EEPROM read failed\n");