--- /n/sources/plan9/sys/src/cmd/unix/u9fs/u9fs.c	Tue Sep 22 06:04:31 2026
+++ /sys/src/cmd/unix/u9fs/u9fs.c	Tue Sep 22 00:00:00 2026
@@ -195,7 +195,7 @@
 		sysfatal("couldn't read message");
 
 	len = GBIT32(rxbuf);
-	if(len <= BIT32SZ)
+	if(len <= BIT32SZ || len > msize)
 		sysfatal("bogus message");
 
 	len -= BIT32SZ;
@@ -224,6 +224,8 @@
 		sysfatal("couldn't read message");
 
 	n = iosize(rxbuf);
+	if(len+n > msize)
+		sysfatal("bogus message");
 	if(readn(fd, rxbuf+len, n) != n)
 		sysfatal("couldn't read message");
 	len += n;