--- a/sys/bus/firewire/fwdev.c
+++ b/sys/bus/firewire/fwdev.c
@@ -529,6 +529,11 @@
 		if ((tinfo->flag & FWTI_BLOCK_ASY) != 0)
 			pay_len = MAX(0, asyreq->req.len - tinfo->hdr_len);
 
+		if (pay_len > sizeof(asyreq->data)) {
+			/* DF-2296: req.len is u16 and was never bounded */
+			err = EINVAL;
+			break;
+		}
 		xfer = fw_xfer_alloc_buf(M_FWXFER, pay_len, PAGE_SIZE/*XXX*/);
 		if (xfer == NULL)
 			return (ENOMEM);
@@ -558,7 +563,7 @@
 		bcopy(fp, (void *)&xfer->send.hdr, tinfo->hdr_len);
 		if (pay_len > 0)
 			bcopy((char *)fp + tinfo->hdr_len,
-			    (void *)&xfer->send.payload, pay_len);
+			    (void *)xfer->send.payload, pay_len);
 		xfer->send.spd = asyreq->req.sped;
 		xfer->act.hand = fw_asy_callback;