--- a/sys/dev/netif/mxge/if_mxge.c
+++ b/sys/dev/netif/mxge/if_mxge.c
@@ -694,6 +694,20 @@
 		status = EIO;
 		goto abort_with_buffer;
 	}
+	/*
+	 * The registered uncompressed size is file metadata; trust only
+	 * what inflate actually produced, and never copy (or read
+	 * uninitialized heap) past it.
+	 */
+	if (zs.total_out < fw_len)
+		fw_len = zs.total_out;
+
+	/* the inflated image must fit the SRAM mapping behind *limit */
+	if (fw_len + MXGE_FW_OFFSET > *limit) {
+		if_printf(sc->ifp, "Firmware image too large\n");
+		status = EIO;
+		goto abort_with_buffer;
+	}
 
 	/* Check id */
 	hdr_offset =