diff --git a/src/avclandrv.c b/src/avclandrv.c
index 8afbc7a..a7f1806 100644
--- a/src/avclandrv.c
+++ b/src/avclandrv.c
@@ -1168,6 +1168,7 @@ uint8_t AVCLAN_parseframe(const uint8_t *bytes, uint8_t len,
     enum : uint8_t {
       TOO_SHORT = 0x01,
       MISMATCH_LENGTH,
+      LENGTH_TOO_BIG,
     } errno;
     uint8_t val;
   } err = {0};
@@ -1186,6 +1187,12 @@ uint8_t AVCLAN_parseframe(const uint8_t *bytes, uint8_t len,
   frame->control = *bytes++;
   frame->length = *bytes++;
 
+  if (frame->length > MAXMSGLEN) {
+    err.errno = LENGTH_TOO_BIG;
+    err.val = frame->length;
+    goto handle_err;
+  }
+
   if ((bytes + frame->length) <= last) {
     memcpy(frame->data, bytes, frame->length);
   } else {
@@ -1203,6 +1210,10 @@ uint8_t AVCLAN_parseframe(const uint8_t *bytes, uint8_t len,
       case MISMATCH_LENGTH:
         RS232_Print("frame->length is longer than remaining data");
         break;
+      case LENGTH_TOO_BIG:
+        RS232_Print("frame->length exceeds MAXMSGLEN: 0x");
+        RS232_PrintHex8(err.val);
+        break;
       default: break;
     }
     RS232_Print("\n");
diff --git a/src/sniffer.c b/src/sniffer.c
index 44f8186..5299a9d 100644
--- a/src/sniffer.c
+++ b/src/sniffer.c
@@ -104,7 +104,9 @@ int main() {
   uint8_t readBinary = 0;
   uint8_t muteBus = 0;
 
-  uint8_t data_tmp[MAXMSGLEN];
+  // Binary-mode REPL includes the full wire preamble (broadcast + 2*addr +
+  // control + length), so size for the worst case.
+  uint8_t data_tmp[MAXMSGLEN + sizeof(AVCLAN_frame_t)];
   uint8_t seqLen = 0; // current length written to data_tmp
 
   uint8_t err = 0;