diff --git a/third_party/nucleus/io/sam_reader.cc b/third_party/nucleus/io/sam_reader.cc
index 04781d78..7d2cbfe0 100644
--- a/third_party/nucleus/io/sam_reader.cc
+++ b/third_party/nucleus/io/sam_reader.cc
@@ -372,6 +372,15 @@ ::nucleus::Status ParseAuxFields(const bam1_t* b,
         // We need to skip 4 bytes for n_elements int that occurs before the
         // array.
         s += 4;
+        // Reject an element count that would walk past the end of the
+        // record. Every scalar aux branch above already bounds-checks; the
+        // 'B' array branch must too. Compute in 64-bit: n_elements is read as
+        // a uint32 into an int, so a value >= 2^31 is itself negative.
+        if (n_elements < 0 ||
+            static_cast<int64_t>(n_elements) * element_size > (end - s)) {
+          return ::nucleus::DataLoss("B-array length exceeds record for tag " +
+                                     tag);
+        }
         if (sub_type == 'c') {
           std::vector<int8_t> all_values;
           for (int i = 0; i < n_elements; i++) {