--- a/sys/dev/netif/iwm/if_iwm_util.c
+++ b/sys/dev/netif/iwm/if_iwm_util.c
@@ -217,7 +217,15 @@
 			paylen, hcmd->len[0]);
 		/* Command is too large */
 		size_t totlen = hdrlen + paylen;
-		if (paylen > IWM_MAX_CMD_PAYLOAD_SIZE) {
+		/*
+		 * A TFD transmit buffer is capped at (4K-4) bytes and its
+		 * length occupies only 12 bits (bits 4-15) of tbs[0].hi_n_len.
+		 * IWM_MAX_CMD_PAYLOAD_SIZE was derived for the 4-byte legacy
+		 * header; with the 8-byte wide header, hdrlen+paylen == 4096
+		 * would truncate the encoded length to zero (and 4093..4095
+		 * already exceed the hw cap).  Bound the total, not the payload.
+		 */
+		if (totlen > IWM_MAX_CMD_PAYLOAD_SIZE + sizeof(cmd->hdr)) {
 			device_printf(sc->sc_dev,
 			    "firmware command too long (%zd bytes)\n",
 			    totlen);