diff --git a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/dbn_ble_srv.c b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/dbn_ble_srv.c
index fa73d31..e28961d 100644
--- a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/dbn_ble_srv.c
+++ b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/dbn_ble_srv.c
@@ -284,6 +284,7 @@ uint8_t set_response_buf(Buf_DBN_BLE *response_dst, uint8_t magic, uint8_t cmd,
 {
     uint8_t ret = 0;
     uint8_t i = 0;
+    if(dat_len > MAX_BLE_DAT_BUF_LEN) dat_len = MAX_BLE_DAT_BUF_LEN;  /* overflow guard */
     clear_buf_dbn_ble(response_dst);
     response_dst->magic = magic;
     response_dst->cmd = cmd;
@@ -979,6 +980,12 @@ void manage_dbn_ble_default(uint8_t *pkg, uint8_t len)
             _req_count = pkg[8];
             if (_req_count > OFFLOG_MAX_QUERY_RECORDS) _req_count = OFFLOG_MAX_QUERY_RECORDS;
             if (_req_count == 0) _req_count = OFFLOG_MAX_QUERY_RECORDS;
+            /* overflow guard: resp dat = 2 + N*32 must fit tmp buf.
+               history: MAX_BLE_TMP_BUF_LEN was 100, 130B write overflowed
+               into g_notify_buftemp and erased pending chunk 2 */
+            { uint16_t _max_rec = (MAX_BLE_TMP_BUF_LEN >= 2) ?
+                ((MAX_BLE_TMP_BUF_LEN - 2) / (uint16_t)sizeof(OfflogEvt)) : 0;
+              if (_req_count > _max_rec) _req_count = _max_rec; }
 
             tmp_ble_buf[_i++] = 0x00;    /* status ok */
             tmp_ble_buf[_i++] = 0;       /* count placeholder */