diff --git a/armsrc/appmain.c b/armsrc/appmain.c
index 7032983f7..71febb7e2 100644
--- a/armsrc/appmain.c
+++ b/armsrc/appmain.c
@@ -2393,6 +2393,9 @@ static void PacketReceived(PacketCommandNG *packet) {
             } else {
                 // Allow reading from any memory address and length in special 'raw' mode.
                 base = NULL;
+                // Boundary check against end of addressable space.
+                if (offset > 0)
+                    count=MIN(count, -offset);
             }
 
             if (isok) {
diff --git a/bootrom/bootrom.c b/bootrom/bootrom.c
index 632fe88d1..9349ffd7c 100644
--- a/bootrom/bootrom.c
+++ b/bootrom/bootrom.c
@@ -186,6 +186,9 @@ static void UsbPacketReceived(uint8_t *packet) {
             } else {
                 // Allow reading from any memory address and length in special 'raw' mode.
                 base = NULL;
+                // Boundary check against end of addressable space.
+                if (offset > 0)
+                    count=MIN(count, -offset);
             }
 
             if (isok) {