diff --git a/test/device.c b/test/device.c
index a44524c..ecfc164 100644
--- a/test/device.c
+++ b/test/device.c
@@ -65,6 +65,15 @@ int main(int argc, char *argv[])
 		fprintf(stderr, "device: cannot read %s\n", argv[1]);
 		return 1;
 	}
+	// An image that runs past flash end cannot execute on hardware, and a
+	// naive copy of it would smash the heap beyond avr->flash — after which
+	// the simulation misbehaves in ways that point everywhere but here.
+	// Refuse it loudly instead.
+	if (boot_base + fw.flashsize > avr->flashend + 1) {
+		fprintf(stderr, "device: %u B at 0x%x runs past flash end 0x%x — image does not fit its slot\n",
+		        (unsigned)fw.flashsize, boot_base, avr->flashend);
+		return 1;
+	}
 	memcpy(avr->flash + boot_base, fw.flash, fw.flashsize);
 	avr->pc = boot_base;
 	avr->codeend = avr->flashend;