--- a/sys/dev/pccard/cardbus/cardbus_cis.c	2026-09-22 21:07:59.711130284 +0000
+++ b/sys/dev/pccard/cardbus/cardbus_cis.c	2026-09-22 21:07:59.711130284 +0000
@@ -365,8 +365,14 @@
 		} else {
 			pci_bar &= ~0x3;
 		}
+		if (pci_bar == 0)	/* masked probe empty (DF-1811) */
+			return (EINVAL);
 		len = 1 << (ffs(pci_bar) - 1);
 	}
+	/* NB: len is either the (untrusted) CIS size field truncated to
+	 * int, or 1<<31 from the probe -- both can be negative. */
+	if (len <= 0)
+		return (EINVAL);
 
 	DEVPRINTF((cbdev, "Opening BAR: type=%s, bar=%02x, len=%04x%s%s\n",
 	    (type == SYS_RES_MEMORY) ? "MEM" : "IO", bar, len,