diff --git a/src/ipc/ipc4/handler-user.c b/src/ipc/ipc4/handler-user.c
index 8aee53d382b3..0d2f5d498274 100644
--- a/src/ipc/ipc4/handler-user.c
+++ b/src/ipc/ipc4/handler-user.c
@@ -1142,6 +1142,14 @@ __cold static int ipc4_process_large_config_get(struct ipc4_message_request *ipc
 
 	/* check for vendor param first */
 	if (config->extension.r.large_param_id == VENDOR_CONFIG_PARAM) {
+		/* data_off_size is a 20-bit host-controlled field, so it can
+		 * claim far more than the hostbox can physically hold.
+		 */
+		if (data_offset > MAILBOX_HOSTBOX_SIZE) {
+			ipc_cmd_err(&ipc_tr, "data_off_size %u exceeds mailbox bound",
+				    data_offset);
+			return IPC4_INVALID_CONFIG_DATA_STRUCT;
+		}
 		/* For now only vendor_config case uses payload from hostbox */
 		dcache_invalidate_region((__sparse_force void __sparse_cache *)MAILBOX_HOSTBOX_BASE,
 					 config->extension.r.data_off_size);