--- ff16p1.c	Sat Sep 13 18:37:13 2025
+++ ff16p2.c	Fri Jul 10 00:06:50 2026
@@ -1,5 +1,5 @@
 /*----------------------------------------------------------------------------/
-/  FatFs - Generic FAT Filesystem Module  R0.16 w/patch 1                     /
+/  FatFs - Generic FAT Filesystem Module  R0.16 w/patch 2                     /
 /-----------------------------------------------------------------------------/
 /
 / Copyright (C) 2025, ChaN, all right reserved.
@@ -41,6 +41,7 @@
 #define MAX_FAT16	0xFFF5			/* Max FAT16 clusters (differs from specs, but right for real DOS/Windows behavior) */
 #define MAX_FAT32	0x0FFFFFF5		/* Max FAT32 clusters (not defined in specs, practical limit) */
 #define MAX_EXFAT	0x7FFFFFFD		/* Max exFAT clusters (differs from specs, implementation limit) */
+#define MIN_EXFAT	0x00000100		/* Min exFAT clusters (Not defined in specs, implementation limit) */
 #define MIN_FAT12	32				/* Min FAT12 clusters (Not defined in specs, implementation limit) */
 #define MIN_VOLUME	64				/* Min volume sectors (Not defined in specs, implementation limit) */
 
@@ -3547,7 +3548,7 @@
 		if (fs->csize == 0)	return FR_NO_FILESYSTEM;	/* (Must be 1..32768 sectors) */
 
 		ncl = ld_32(fs->win + BPB_NumClusEx);			/* Number of clusters */
-		if (ncl > MAX_EXFAT) return FR_NO_FILESYSTEM;	/* (Too many clusters) */
+		if (ncl < MIN_EXFAT || ncl > MAX_EXFAT) return FR_NO_FILESYSTEM;	/* (Wrong cluster count) */
 		fs->n_fatent = ncl + 2;
 
 		/* Boundaries and Limits */
@@ -3592,6 +3593,7 @@
 
 		fasize = ld_16(fs->win + BPB_FATSz16);		/* Number of sectors per FAT */
 		if (fasize == 0) fasize = ld_32(fs->win + BPB_FATSz32);
+		if (fasize >= 0x200000) return FR_NO_FILESYSTEM;	/* (Must be smaller than max FAT size) */
 		fs->fsize = fasize;
 
 		fs->n_fats = fs->win[BPB_NumFATs];				/* Number of FATs */
@@ -5529,7 +5531,7 @@
 					WCHAR hs;
 					UINT nw;
 
-					for (si = di = hs = 0; si < dj.dir[XDIR_NumLabel]; si++) {	/* Extract volume label from 83 entry */
+					for (si = di = hs = 0; si < dj.dir[XDIR_NumLabel] && si < 11; si++) {	/* Extract volume label from 83 entry */
 						wc = ld_16(dj.dir + XDIR_Label + si * 2);
 						if (hs == 0 && IsSurrogate(wc)) {	/* Is the code a surrogate? */
 							hs = wc; continue;