diff --git a/core/wma/src/wma_ocb.c b/core/wma/src/wma_ocb.c
index 71bedfc1a6..0849845ea0 100644
--- a/core/wma/src/wma_ocb.c
+++ b/core/wma/src/wma_ocb.c
@@ -673,6 +673,14 @@ static int wma_dcc_stats_event_handler(void *handle, uint8_t *event_buf,
 	response->num_channels = fix_param->num_channels;
 	response->channel_stats_array_len =
 		fix_param->num_channels * sizeof(wmi_dcc_ndl_stats_per_channel);
+
+	if (fix_param->num_channels > param_tlvs->num_stats_per_channel_list) {
+		WMA_LOGE("FW message num_chan %d more than TLV hdr %d",
+			 fix_param->num_channels,
+			 param_tlvs->num_stats_per_channel_list);
+		return -EINVAL;
+	}
+
 	response->channel_stats_array = ((void *)response) + sizeof(*response);
 	qdf_mem_copy(response->channel_stats_array,
 		     param_tlvs->stats_per_channel_list,
diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c
index 826f147662..be4dc26d93 100644
--- a/core/wma/src/wma_scan_roam.c
+++ b/core/wma/src/wma_scan_roam.c
@@ -3561,6 +3561,14 @@ int wma_extscan_operations_event_handler(void *handle,
 	case WMI_EXTSCAN_CYCLE_STARTED_EVENT:
 		WMA_LOGD("%s: received WMI_EXTSCAN_CYCLE_STARTED_EVENT",
 			 __func__);
+
+		if (oprn_event->num_buckets > param_buf->num_bucket_id) {
+			WMA_LOGE("FW mesg num_buk %d more than TLV hdr %d",
+				 oprn_event->num_buckets,
+				 param_buf->num_bucket_id);
+			return -EINVAL;
+		}
+
 		cds_host_diag_log_work(&wma->extscan_wake_lock,
 				       WMA_EXTSCAN_CYCLE_WAKE_LOCK_DURATION,
 				       WIFI_POWER_EVENT_WAKELOCK_EXT_SCAN);