diff --git a/core/mac/inc/sir_api.h b/core/mac/inc/sir_api.h
index d19323584549..26ce1d4dfcb3 100644
--- a/core/mac/inc/sir_api.h
+++ b/core/mac/inc/sir_api.h
@@ -108,7 +108,10 @@ typedef uint8_t tSirVersionString[SIR_VERSION_STRING_LEN];
 #define MAX_VDEV_SUPPORTED                        4
 
 #define MAX_POWER_DBG_ARGS_SUPPORTED 8
-
+#define QOS_MAP_MAX_EX  21
+#define QOS_MAP_LEN_MIN 16
+#define QOS_MAP_LEN_MAX \
+	(QOS_MAP_LEN_MIN + 2 * QOS_MAP_MAX_EX)
 #define NUM_CHAINS_MAX  2
 
 /**
diff --git a/core/mac/src/sys/legacy/src/utils/src/utils_parser.c b/core/mac/src/sys/legacy/src/utils/src/utils_parser.c
index 32543fa9fc86..d8c4c5a1e8b5 100644
--- a/core/mac/src/sys/legacy/src/utils/src/utils_parser.c
+++ b/core/mac/src/sys/legacy/src/utils/src/utils_parser.c
@@ -712,7 +712,11 @@ void convert_qos_mapset_frame(tpAniSirGlobal pMac, tSirQosMapSet *Qos,
 
 	qos_dscp_sz = (sizeof(Qos->dscp_exceptions)/2);
 	dot11_dscp_sz = sizeof(dot11fIE->dscp_exceptions);
-	Qos->num_dscp_exceptions = (dot11fIE->num_dscp_exceptions - 16) / 2;
+	if (dot11fIE->num_dscp_exceptions > QOS_MAP_LEN_MAX)
+		dot11fIE->num_dscp_exceptions = QOS_MAP_LEN_MAX;
+	Qos->num_dscp_exceptions =
+		(dot11fIE->num_dscp_exceptions - QOS_MAP_LEN_MIN) / 2;
+
 	for (i = 0;
 			i < Qos->num_dscp_exceptions &&
 			i < qos_dscp_sz && j < dot11_dscp_sz;