diff --git a/nimble/controller/include/controller/ble_ll_scan.h b/nimble/controller/include/controller/ble_ll_scan.h
index efb856812..b4415b790 100644
--- a/nimble/controller/include/controller/ble_ll_scan.h
+++ b/nimble/controller/include/controller/ble_ll_scan.h
@@ -161,7 +161,7 @@ int ble_ll_scan_set_scan_params(uint8_t *cmd);
 int ble_ll_scan_set_enable(uint8_t *cmd, uint8_t ext);
 
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_EXT_ADV)
-int ble_ll_set_ext_scan_params(uint8_t *cmd);
+int ble_ll_set_ext_scan_params(uint8_t *cmd, uint8_t cmdlen);
 #endif
 
 /*--- Controller Internal API ---*/
diff --git a/nimble/controller/src/ble_ll_hci.c b/nimble/controller/src/ble_ll_hci.c
index fe448befa..b3c4bcf8a 100644
--- a/nimble/controller/src/ble_ll_hci.c
+++ b/nimble/controller/src/ble_ll_hci.c
@@ -1039,9 +1039,8 @@ ble_ll_hci_le_cmd_proc(uint8_t *cmdbuf, uint16_t ocf, uint8_t *rsplen,
 #endif
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_EXT_ADV)
     case BLE_HCI_OCF_LE_SET_EXT_SCAN_PARAM:
-        if (len == BLE_HCI_LE_SET_EXT_SCAN_PARAM_LEN) {
-            rc = ble_ll_set_ext_scan_params(cmdbuf);
-        }
+        /* variable length */
+        rc = ble_ll_set_ext_scan_params(cmdbuf, len);
         break;
     case BLE_HCI_OCF_LE_SET_EXT_SCAN_ENABLE:
         if (len == BLE_HCI_LE_SET_EXT_SCAN_ENABLE_LEN) {
diff --git a/nimble/controller/src/ble_ll_scan.c b/nimble/controller/src/ble_ll_scan.c
index d39305d98..82d80de8e 100644
--- a/nimble/controller/src/ble_ll_scan.c
+++ b/nimble/controller/src/ble_ll_scan.c
@@ -2632,7 +2632,7 @@ ble_ll_check_scan_params(uint8_t type, uint16_t itvl, uint16_t window)
 }
 
 int
-ble_ll_set_ext_scan_params(uint8_t *cmd)
+ble_ll_set_ext_scan_params(uint8_t *cmd, uint8_t cmdlen)
 {
     struct ble_ll_scan_params new_params[BLE_LL_SCAN_PHY_NUMBER] = { };
     struct ble_ll_scan_params *uncoded = &new_params[PHY_UNCODED];
@@ -2640,6 +2640,10 @@ ble_ll_set_ext_scan_params(uint8_t *cmd)
     uint8_t idx;
     int rc;
 
+    if (cmdlen < 3) {
+        return BLE_ERR_INV_HCI_CMD_PARMS;
+    }
+
     /* If already enabled, we return an error */
     if (g_ble_ll_scan_sm.scan_enabled) {
         return BLE_ERR_CMD_DISALLOWED;
@@ -2671,6 +2675,10 @@ ble_ll_set_ext_scan_params(uint8_t *cmd)
 
     idx = 3;
     if (cmd[2] & BLE_HCI_LE_PHY_1M_PREF_MASK) {
+        if (cmdlen < idx + 5) {
+            return BLE_ERR_INV_HCI_CMD_PARMS;
+        }
+
         uncoded->scan_type = cmd[idx];
         idx++;
         uncoded->scan_itvl = get_le16(cmd + idx);
@@ -2691,6 +2699,10 @@ ble_ll_set_ext_scan_params(uint8_t *cmd)
 
 #if MYNEWT_VAL(BLE_LL_CFG_FEAT_LE_CODED_PHY)
     if (cmd[2] & BLE_HCI_LE_PHY_CODED_PREF_MASK) {
+        if (cmdlen < idx + 5) {
+            return BLE_ERR_INV_HCI_CMD_PARMS;
+        }
+
         coded->scan_type = cmd[idx];
         idx++;
         coded->scan_itvl = get_le16(cmd + idx);