diff --git a/plugins/channelrx/demodpacket/packetdemodframer.h b/plugins/channelrx/demodpacket/packetdemodframer.h
index 5468bcb0b..4abd8137f 100644
--- a/plugins/channelrx/demodpacket/packetdemodframer.h
+++ b/plugins/channelrx/demodpacket/packetdemodframer.h
@@ -234,7 +234,7 @@ private:
 
         if (bit == 1)
         {
-            d.m_onesCount++;
+            d.m_onesCount = std::min(d.m_onesCount + 1, 7);
 
             // Shouldn't ever get 7 1s in a row
             if ((d.m_onesCount == 7) && d.m_gotSOP)
@@ -288,6 +288,14 @@ private:
             d.m_bits = 0;
             d.m_bitCount = 0;
         }
+        // Outside a frame only the run-of-ones detector is needed to find a flag.
+        // Do not let m_bitCount grow without bound before acquisition or after an
+        // abort: shifting by >= 32 above is undefined (caught by the IQ tests).
+        if (!d.m_gotSOP)
+        {
+            d.m_bits = 0;
+            d.m_bitCount = 0;
+        }
     }
 
     // True if the assembled bytes carry a matching CRC, in which case packet is the frame