--- a/sys/bus/u4b/usb_hid.c
+++ b/sys/bus/u4b/usb_hid.c
@@ -428,6 +428,11 @@
 				s->loc_count = dval & mask;
 				break;
 			case 10:	/* Push */
+				if (s->pushlevel >= MAXPUSH - 1) {
+					DPRINTFN(0, "Cannot push "
+					    "item @ %d\n", s->pushlevel + 1);
+					break;
+				}
 				s->pushlevel ++;
 				if (s->pushlevel < MAXPUSH) {
 					s->cur[s->pushlevel] = *c;
@@ -442,6 +447,11 @@
 				}
 				break;
 			case 11:	/* Pop */
+				if (s->pushlevel == 0) {
+					DPRINTFN(0, "Cannot pop "
+					    "item @ %d\n", s->pushlevel);
+					break;
+				}
 				s->pushlevel --;
 				if (s->pushlevel < MAXPUSH) {
 					/* preserve position */