diff --git a/sql-common/client.c b/sql-common/client.c
index be24c5e89e4..ef1e3c1b7d4 100644
--- a/sql-common/client.c
+++ b/sql-common/client.c
@@ -3415,6 +3415,12 @@ CLI_MYSQL_REAL_CONNECT(MYSQL *mysql,const char *host, const char *user,
     mysql->server_status=uint2korr(end+3);
     mysql->server_capabilities|= uint2korr(end+5) << 16;
     pkt_scramble_len= end[7];
+    if (pkt_scramble_len < 0)
+    {
+      set_mysql_error(mysql, CR_MALFORMED_PACKET,
+                      unknown_sqlstate);        /* purecov: inspected */
+      goto error;
+    }
   }
   end+= 18;
 
diff --git a/sql/sql_acl.cc b/sql/sql_acl.cc
index d3715fd2312..242967fff6a 100644
--- a/sql/sql_acl.cc
+++ b/sql/sql_acl.cc
@@ -8032,6 +8032,7 @@ static bool send_server_handshake_packet(MPVIO_EXT *mpvio,
   int2store(end + 3, mpvio->server_status[0]);
   int2store(end + 5, mpvio->client_capabilities >> 16);
   end[7]= data_len;
+  DBUG_EXECUTE_IF("poison_srv_handshake_scramble_len", end[7]= -100;);
   bzero(end + 8, 10);
   end+= 18;
   /* write scramble tail */