@@ -23,24 +23,49 @@ const { ZCLError } = require('./index');
  * @throws {ZCLError} With zclStatus `MALFORMED_COMMAND` when parsing fails or
  *   the payload is shorter than the args struct's minimum byte length.
  */
-function parseCommandArgs(command, data) {
-  const argsType = command.args;
-
-  // Commands declared with `encodeMissingFieldsBehavior: 'skip'` allow trailing
-  // fields to be omitted (e.g. OTA `hardwareVersion` is only present when its
-  // fieldControl bit is set). For those we cannot derive a strict minimum from
-  // the struct definition and rely on the try/catch below to catch overruns.
-  if (command.encodeMissingFieldsBehavior !== 'skip') {
+/**
+ * Minimum payload length we'll accept before invoking the parser.
+ *
+ * For commands declared with `encodeMissingFieldsBehavior: 'skip'`, trailing
+ * fields may be intentionally omitted (e.g. OTA `hardwareVersion` is only
+ * present when its `fieldControl` bit is set). We can't derive the strict
+ * minimum from the struct alone, but every such command in practice has a
+ * mandatory leading discriminator (status, fieldControl, payloadType) that
+ * determines which subsequent fields are present. Without that leading byte,
+ * the parsed result is meaningless; with it, the parser correctly omits
+ * optional trailing fields.
+ *
+ * So for 'skip' commands we require at least the first field's byte width.
+ * For non-'skip' commands we require the full fixed-portion length.
+ *
+ * @param {object} argsType - The ZCLStruct class for this command's args.
+ * @param {boolean} skipMode - Whether the command uses `encodeMissingFieldsBehavior: 'skip'`.
+ * @returns {number} Minimum byte length the payload must carry.
+ */
+function computeMinLength(argsType, skipMode) {
+  if (!skipMode) {
     // Struct.length convention:
     //   > 0 : exact byte count for an all-fixed-size struct
     //   < 0 : negative of the fixed-portion size for a varsize struct
     //   = 0 : no payload required
-    // For both fixed and varsize structs, |declaredLength| is the minimum
-    // number of bytes the payload must carry to populate the fixed fields.
-    const minLength = Math.abs(argsType.length);
-    if (data.length < minLength) {
-      throw new ZCLError('MALFORMED_COMMAND');
-    }
+    return Math.abs(argsType.length);
+  }
+
+  const firstField = Object.values(argsType.fields)[0];
+  if (!firstField) return 0;
+  // Fixed-width field's length is a positive integer; varsize is negative or 0.
+  // For varsize first fields (uncommon for 'skip' commands), require at least
+  // 1 byte so the length prefix is present.
+  return firstField.length > 0 ? firstField.length : 1;
+}
+
+function parseCommandArgs(command, data) {
+  const argsType = command.args;
+  const skipMode = command.encodeMissingFieldsBehavior === 'skip';
+
+  const minLength = computeMinLength(argsType, skipMode);
+  if (data.length < minLength) {
+    throw new ZCLError('MALFORMED_COMMAND');
   }
 
   try {
 
@@ -1,6 +1,7 @@
 'use strict';
 
 const { ZCLDataType, ZCLDataTypes, ZCLStruct } = require('./zclTypes');
+const { ZCLError } = require('./util');
 
 const ZCLFrameControlBitmap = ZCLDataTypes.map8(
   'clusterSpecific',
@@ -84,6 +85,16 @@ const ZCLAttributeDataRecord = (withStatus, attributes) =>
             res.name = attributes[res.id].name || `unknown_attr_${res.id}`;
           }
 
+          // Validate that enough bytes remain for the value field before parsing.
+          // Without this, fixed-width primitives in @athombv/data-types silently
+          // return 0 on short input - which for IAS Zone `zoneStatus` (map16)
+          // produces an all-bits-false bitmap that looks like "all alarms clear",
+          // and for any status-bearing attribute promotes a truncated value into
+          // a SUCCESS-looking enum.
+          if (DataType.length > 0 && buf.length - i < DataType.length) {
+            throw new ZCLError('MALFORMED_COMMAND');
+          }
+
           const entry = DataType.fromBuffer(buf, i, true);
           if (DataType.length > 0) {
             i += DataType.length;
 
@@ -5,9 +5,13 @@ const assert = require('node:assert');
 const Node = require('../lib/Node');
 const BoundCluster = require('../lib/BoundCluster');
 const IASZoneCluster = require('../lib/clusters/iasZone');
+const OTACluster = require('../lib/clusters/ota');
 const { ZCLStandardHeader } = require('../lib/zclFrames');
 const { ZCLDataTypes } = require('../lib/zclTypes');
 
+// ZCL data-type id for map16 (declared in @athombv/data-types).
+const ZCL_TYPE_ID_MAP16 = 25;
+
 /**
  * Helper: build a mock Node that captures every frame sent back via sendFrame.
  * Unlike `createMockNode({loopback:true})`, this lets the test inspect the
@@ -173,4 +177,144 @@ describe('Malformed frame hardening', function () {
       );
     });
   });
+
+  describe('Attribute report (reportAttributes / cmdId 0x0A)', function () {
+    /**
+     * Build a reportAttributes frame carrying one attribute record.
+     * @param {number} attrId
+     * @param {number} typeId
+     * @param {Buffer} value - the raw value bytes (may be truncated for tests).
+     */
+    function buildReportAttributesFrame(attrId, typeId, value) {
+      const frame = new ZCLStandardHeader();
+      frame.cmdId = 0x0a;
+      frame.frameControl.directionToClient = true;
+      frame.frameControl.clusterSpecific = false; // global command
+      const header = Buffer.alloc(3);
+      header.writeUInt16LE(attrId, 0);
+      header.writeUInt8(typeId, 2);
+      frame.data = Buffer.concat([header, value]);
+      return frame;
+    }
+
+    it('should not emit attr.zoneStatus on truncated map16 value', async function () {
+      const { node } = createCapturingNode(1, IASZoneCluster.ID);
+
+      let emitted = false;
+      node.endpoints[1].clusters.iasZone.on('attr.zoneStatus', () => {
+        emitted = true;
+      });
+
+      // Attribute id=0x0002 (zoneStatus), type=map16, value bytes missing entirely.
+      const frame = buildReportAttributesFrame(0x0002, ZCL_TYPE_ID_MAP16, Buffer.alloc(0));
+      await node.handleFrame(1, IASZoneCluster.ID, frame.toBuffer(), {});
+
+      assert.strictEqual(
+        emitted,
+        false,
+        'attr.zoneStatus must not fire when the map16 value bytes are missing',
+      );
+    });
+
+    it('should respond with MALFORMED_COMMAND on truncated attribute value', async function () {
+      const { node, sentFrames } = createCapturingNode(1, IASZoneCluster.ID);
+
+      // 1 byte of map16 instead of 2.
+      const frame = buildReportAttributesFrame(0x0002, ZCL_TYPE_ID_MAP16, Buffer.from([0x01]));
+      await node.handleFrame(1, IASZoneCluster.ID, frame.toBuffer(), {});
+
+      const response = sentFrames
+        .map((f) => parseDefaultResponse(f.raw))
+        .find((r) => r && r.forCmdId === 0x0a);
+
+      assert.ok(response, 'expected a default-response frame to be sent back');
+      assert.strictEqual(
+        response.status,
+        'MALFORMED_COMMAND',
+        `expected MALFORMED_COMMAND, got ${response.status}`,
+      );
+    });
+
+    it('should still emit attr.zoneStatus on well-formed report (regression)', async function () {
+      const { node } = createCapturingNode(1, IASZoneCluster.ID);
+
+      let received = null;
+      node.endpoints[1].clusters.iasZone.on('attr.zoneStatus', (val) => {
+        received = val;
+      });
+
+      // Full report: attrId=0x0002, typeId=map16, value=[0x01, 0x00] (alarm1 bit set).
+      const value = Buffer.from([0x01, 0x00]);
+      const frame = buildReportAttributesFrame(0x0002, ZCL_TYPE_ID_MAP16, value);
+      await node.handleFrame(1, IASZoneCluster.ID, frame.toBuffer(), {});
+
+      assert.ok(received, 'attr.zoneStatus should have fired');
+      assert.strictEqual(received.alarm1, true);
+    });
+  });
+
+  describe('encodeMissingFieldsBehavior: "skip" - empty payload', function () {
+    it('should reject empty queryNextImageRequest', async function () {
+      const { node, sentFrames } = createCapturingNode(1, OTACluster.ID);
+      node.endpoints[1].bind('ota', new BoundCluster());
+
+      const frame = new ZCLStandardHeader();
+      frame.cmdId = OTACluster.COMMANDS.queryNextImageRequest.id;
+      frame.frameControl.directionToClient = false;
+      frame.frameControl.clusterSpecific = true;
+      frame.data = Buffer.alloc(0); // Pre-fix: parses with all zero-filled fields.
+
+      await node.handleFrame(1, OTACluster.ID, frame.toBuffer(), {});
+
+      const response = sentFrames
+        .map((f) => parseDefaultResponse(f.raw))
+        .find((r) => r && r.forCmdId === OTACluster.COMMANDS.queryNextImageRequest.id);
+
+      assert.ok(response, 'expected a default-response frame');
+      assert.strictEqual(
+        response.status,
+        'MALFORMED_COMMAND',
+        `expected MALFORMED_COMMAND, got ${response.status}`,
+      );
+    });
+
+    it('should still accept queryNextImageRequest without trailing hardwareVersion (regression)', async function () {
+      const { node } = createCapturingNode(1, OTACluster.ID);
+
+      let receivedArgs = null;
+      node.endpoints[1].bind(
+        'ota',
+        new (class extends BoundCluster {
+          async queryNextImageRequest(args) {
+            receivedArgs = args;
+            return { status: 'NO_IMAGE_AVAILABLE' };
+          }
+        })(),
+      );
+
+      const frame = new ZCLStandardHeader();
+      frame.cmdId = OTACluster.COMMANDS.queryNextImageRequest.id;
+      frame.frameControl.directionToClient = false;
+      frame.frameControl.clusterSpecific = true;
+      // 9 bytes: fieldControl(1) + manufacturerCode(2) + imageType(2) + fileVersion(4).
+      // Trailing hardwareVersion(2) omitted because fieldControl bit 0 is not set.
+      frame.data = Buffer.from([
+        0x00, // fieldControl
+        0x34,
+        0x12, // manufacturerCode = 0x1234
+        0x21,
+        0x43, // imageType = 0x4321
+        0x01,
+        0x00,
+        0x00,
+        0x00, // fileVersion = 1
+      ]);
+
+      await node.handleFrame(1, OTACluster.ID, frame.toBuffer(), {});
+
+      assert.ok(receivedArgs, 'handler should have been called');
+      assert.strictEqual(receivedArgs.manufacturerCode, 0x1234);
+      assert.strictEqual(receivedArgs.imageType, 0x4321);
+    });
+  });
 });