diff --git a/tests/fakes/source/write_out_of_range.rb b/tests/fakes/source/write_out_of_range.rb
new file mode 100755
index 0000000..529de7e
--- /dev/null
+++ b/tests/fakes/source/write_out_of_range.rb
@@ -0,0 +1,21 @@
+#!/usr/bin/env ruby
+# encoding: utf-8
+
+# Connect, read the hello then make a write request with an impossible
+# (from,len) pair.  We expect an error response, and not to be
+# disconnected.
+
+require 'flexnbd/fake_source'
+include FlexNBD::FakeSource
+
+addr, port = *ARGV
+client_sock = connect( addr, port, "Timed out connecting" )
+read_hello( client_sock )
+write_write_request( client_sock, 1 << 31, 1 << 31, "myhandle" )
+response = read_response( client_sock )
+
+fail "Not an error" if response[:error] == 0
+fail "Wrong handle" unless "myhandle" == response[:handle]
+
+client_sock.close
+exit(0)
diff --git a/tests/flexnbd/fake_source.rb b/tests/flexnbd/fake_source.rb
index 3a15c03..798e70e 100644
--- a/tests/flexnbd/fake_source.rb
+++ b/tests/flexnbd/fake_source.rb
@@ -24,6 +24,31 @@ module FlexNBD
     end
 
 
+    def write_write_request( client_sock, from, len, handle )
+      fail "Bad handle" unless handle.length == 8
+
+      client_sock.write( "\x25\x60\x95\x13" )
+      client_sock.write( "\x00\x00\x00\x01" )
+      client_sock.write( handle )
+      client_sock.write( "\x0"*4 )
+      client_sock.write( [from].pack( 'N' ) )
+      client_sock.write( [len ].pack( 'N' ) )
+    end
+
+
+    def read_response( client_sock )
+      magic = client_sock.read(4)
+      error_s = client_sock.read(4)
+      handle = client_sock.read(8)
+
+      {
+        :magic => magic,
+        :error => error_s.unpack("N"),
+        :handle => handle
+      }
+    end
+
+
     def timing_out( time, msg )
       begin
         Timeout.timeout( time ) do
diff --git a/tests/nbd_scenarios b/tests/nbd_scenarios
index ee246bd..d9ab4b8 100644
--- a/tests/nbd_scenarios
+++ b/tests/nbd_scenarios
@@ -344,6 +344,11 @@ class NBDConnectDestFailureScenarios < Test::Unit::TestCase
   end
 
 
+  def test_bad_write
+    run_fake( "source/write_out_of_range" )
+  end
+
+
   private
   def run_fake( name )
     @env.run_fake( name, @env.ip, @env.port1 )