diff --git a/httpd/page_impl.c b/httpd/page_impl.c
index cc1b98a..66b234e 100644
--- a/httpd/page_impl.c
+++ b/httpd/page_impl.c
@@ -97,7 +97,7 @@ void itoa_html(uint8_t v)
 	char_to_html('0' + (v % 10));
 }
 
-void itoa16_html(uint16_t v)
+void itoa16_html(uint16_t v) /* sufficient for VLAN IDs (max 4094) */
 {
 	uint8_t print_zeros = 0;
 	uint8_t d;
@@ -842,8 +842,9 @@ void send_cmd_log(void)
 
 void send_vlanlist(void)
 {
-	/* Worst case per entry: {"id":4094,"name":"<name>"}, ~45 bytes.
-	 * HTTP header ~50 bytes. TCP_OUTBUF_SIZE=2500 fits ~53 VLANs safely. */
+	/* Worst case per entry: {"id":4094,"name":"<117-char name>"} = 138 bytes
+	 * (name bound: CMD_BUF_SIZE=128 minus command prefix); +1 for closing ']'.
+	 * At worst case ~18 VLANs fit; typical configs with short names fit many more. */
 	__xdata uint16_t i;
 	__xdata uint16_t n;
 	uint8_t first = 1;
@@ -854,9 +855,12 @@ void send_vlanlist(void)
 	for (i = 1; i < 4095; i++) {
 		if (vlan_get(i) < 0)
 			continue;
-		if (!(sfr_data[0] & 0x02))
+		if (!(sfr_data[0] & 0x02)) /* bit 1: VLAN table entry valid */
 			continue;
 
+		if (slen + 139 > TCP_OUTBUF_SIZE) /* 138 bytes worst-case entry + 1 byte for closing ']' */
+			break;
+
 		if (!first)
 			char_to_html(',');
 		first = 0;
@@ -873,8 +877,6 @@ void send_vlanlist(void)
 
 		slen += strtox(outbuf + slen, "\"}");
 
-		if (slen > TCP_OUTBUF_SIZE - 60)
-			break;
 	}
 
 	char_to_html(']');