--- a/sys/dev/pccard/cardbus/cardbus_cis.c	2026-09-22 21:07:59.711130284 +0000
+++ b/sys/dev/pccard/cardbus/cardbus_cis.c	2026-09-22 21:07:59.711130284 +0000
@@ -275,7 +275,9 @@
 	case PCCARD_FUNCTION_NETWORK:
 		switch (type) {
 		case PCCARD_TPLFE_TYPE_LAN_NID:
-			if (tupledata[1] > sizeof(dinfo->funce.lan.nid)) {
+			/* nid length must match the tuple payload */
+			if (tupledata[1] > sizeof(dinfo->funce.lan.nid) ||
+			    tupledata[1] != len - 2) {
 				/* ignore, warning? */
 				return (0);
 			}
@@ -283,7 +285,8 @@
 			    tupledata[1]);
 			break;
 		}
-		dinfo->fepresent |= 1<<type;
+		if (type < 32)	/* 1<<type on uint32 must not overflow */
+			dinfo->fepresent |= 1<<type;
 		break;
 	}
 	return (0);