diff --git a/firmware/main/frame_client.c b/firmware/main/frame_client.c
index e635090..1ee16d4 100644
--- a/firmware/main/frame_client.c
+++ b/firmware/main/frame_client.c
@@ -591,7 +591,12 @@ static int fetch_face_labels(const frame_config_t *cfg, manage_face_label_t *out
 
     uint32_t count = 0;
     json_extract_uint(body, "count", &count);
-    if ((int)count > max_labels) {
+    /* Unsigned compare: casting count to int first let a server-supplied
+     * value >= 2^31 (still a perfectly ordinary decimal in the JSON) go
+     * negative, skipping this clamp entirely and driving the loop below
+     * with the full attacker/server-controlled count -- out[found] is a
+     * fixed MANAGE_FACE_LABELS_MAX-element caller stack array. */
+    if (count > (uint32_t)max_labels) {
         count = (uint32_t)max_labels;
     }