diff --git a/src/hb-ot-kern-table.hh b/src/hb-ot-kern-table.hh
index 28ea9526d..b0ed4399b 100644
--- a/src/hb-ot-kern-table.hh
+++ b/src/hb-ot-kern-table.hh
@@ -444,7 +444,7 @@ struct KernSubTableFormat3
     return_trace (true); /* Disabled.  See above. */
     return_trace (c->check_struct (this) &&
 		  c->check_range (kernValueZ,
-				  kernValueCount +
+				  kernValueCount * sizeof (FWORD) +
 				  glyphCount * 2 +
 				  leftClassCount * rightClassCount));
   }