diff --git a/src/boot/efi/vmm.c b/src/boot/efi/vmm.c
index 5d20b3a195b..1d04509a1e8 100644
--- a/src/boot/efi/vmm.c
+++ b/src/boot/efi/vmm.c
@@ -307,9 +307,10 @@ const char* smbios_find_oem_string(const char *name) {
 
         assert(left >= type11->header.length); /* get_smbios_table() already validated this */
         left -= type11->header.length;
+        const char *limit = s + left;
 
-        for (const char *p = s; p < s + left; ) {
-                const char *e = memchr(p, 0, s + left - p);
+        for (const char *p = s; p < limit; ) {
+                const char *e = memchr(p, 0, limit - p);
                 if (!e || e == p) /* Double NUL byte means we've reached the end of the OEM strings. */
                         break;