diff --git a/Core/Debugger/WebSocket/GPUBufferSubscriber.cpp b/Core/Debugger/WebSocket/GPUBufferSubscriber.cpp
index d7e8e92def..649cd9650e 100644
--- a/Core/Debugger/WebSocket/GPUBufferSubscriber.cpp
+++ b/Core/Debugger/WebSocket/GPUBufferSubscriber.cpp
@@ -388,12 +388,11 @@ void WebSocketGPUBufferTexture(DebuggerRequest &req) {
 	u32 level = 0;
 	if (!req.ParamU32("level", &level, false, DebuggerParamType::OPTIONAL))
 		return;
-	// GPU_GetCurrentTexture() takes a plain int; a client-supplied value whose
-	// u32->int conversion is negative would skip backends' "level >= mip count"
-	// bounds check (which only fires for level > 0), reaching backend texture-copy
-	// code with a bogus mip index.
-	if (level > 0x7FFFFFFF)
+	// Sanity check the level, to avoid overflow hacks. Also it just can't be very high,
+	// we currently support 12 levels for replacement (the PSP only supports 8).
+	if (level > 12) {
 		return req.Fail("Invalid level");
+	}
 
 	GenericStreamBuffer(req, [level](const GPUDebugBuffer *&buf, bool *isFramebuffer) {
 		return GPUStepping::GPU_GetCurrentTexture(buf, level, isFramebuffer);
diff --git a/Core/Replay.cpp b/Core/Replay.cpp
index 0a500d5343..7a32ca207a 100644
--- a/Core/Replay.cpp
+++ b/Core/Replay.cpp
@@ -154,9 +154,7 @@ bool ReplayExecuteBlob(int version, const std::vector<uint8_t> &data) {
 
 		if ((int)item.info.action & (int)ReplayAction::MASK_SIDEDATA) {
 			// Subtraction-based check (rather than i + item.info.size > sz) avoids
-			// wraparound on platforms where size_t is 32-bit, where a large enough
-			// item.info.size could otherwise make the addition overflow and wrap
-			// below sz, defeating this bounds check before the memcpy below.
+			// wraparound on platforms where size_t is 32-bit. Bound checking because memcpy.
 			if (item.info.size > sz - i) {
 				ERROR_LOG(Log::System, "Truncated replay data at %lld during side data", (long long)i);
 				break;