--- a/sys/bus/firewire/fwcrom.c
+++ b/sys/bus/firewire/fwcrom.c
@@ -112,14 +112,21 @@
 		return;
 	reg = crom_get(cc);
 	if ((reg->key & CSRTYPE_MASK) == CSRTYPE_D) {
+		struct csrdirectory *dir;
+
 		if (cc->depth >= CROM_MAX_DEPTH) {
 			kprintf("crom_next: too deep\n");
 			goto again;
 		}
+		dir = (struct csrdirectory *)(reg + reg->val);
+		if ((vm_offset_t)dir > CROM_END(cc) + 1 - sizeof(*dir)) {
+			/* directory outside the ROM: skip the entry */
+			goto again;
+		}
 		cc->depth ++;
 
 		ptr = &cc->stack[cc->depth];
-		ptr->dir = (struct csrdirectory *) (reg + reg->val);
+		ptr->dir = dir;
 		ptr->index = 0;
 		goto check;
 	}