diff --git a/test/vpnor/Makefile.am.include b/test/vpnor/Makefile.am.include
index b01bf65..f0e0214 100644
--- a/test/vpnor/Makefile.am.include
+++ b/test/vpnor/Makefile.am.include
@@ -167,6 +167,19 @@
 test_vpnor_toc_missing_file_LDFLAGS = $(OESDK_TESTCASE_FLAGS)
 test_vpnor_toc_missing_file_LDADD = $(VPNOR_LDADD)
 
+test_vpnor_create_read_window_oob_SOURCES = \
+	$(TEST_MBOX_VPNOR_SRCS) $(TEST_MOCK_SRCS) \
+	mboxd_msg.c \
+	mboxd_windows.c \
+	mboxd_lpc.c \
+	mboxd_lpc_virtual.cpp \
+	mboxd_pnor_partition_table.cpp \
+	mboxd_flash_virtual.cpp \
+	pnor_partition.cpp \
+	%reldir%/create_read_window_oob.cpp
+test_vpnor_create_read_window_oob_LDFLAGS = $(OESDK_TESTCASE_FLAGS)
+test_vpnor_create_read_window_oob_LDADD = $(VPNOR_LDADD)
+
 if VIRTUAL_PNOR_ENABLED
 check_PROGRAMS += \
 	%reldir%/create_pnor_partition_table \
@@ -184,5 +197,8 @@
 	%reldir%/toc_overlap \
 	%reldir%/toc_lookup_found \
 	%reldir%/toc_lookup_failed \
-	%reldir%/toc_missing_file
+	%reldir%/toc_missing_file \
+	%reldir%/create_read_window_oob
+
+XFAIL_TESTS += %reldir%/create_read_window_oob
 endif
diff --git a/test/vpnor/create_read_window_oob.cpp b/test/vpnor/create_read_window_oob.cpp
new file mode 100644
index 0000000..ce85617
--- /dev/null
+++ b/test/vpnor/create_read_window_oob.cpp
@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2018 IBM Corp.
+
+#include <assert.h>
+#include <string.h>
+
+#include "config.h"
+#include "mboxd_pnor_partition_table.h"
+
+extern "C" {
+#include "test/mbox.h"
+#include "test/system.h"
+}
+
+#include "test/vpnor/tmpd.hpp"
+
+const std::string toc[] = {
+    "partition01=HBB,00001000,00002000,80,ECC,READONLY",
+};
+
+static constexpr auto BLOCK_SIZE = 4096;
+static constexpr auto MEM_SIZE = (BLOCK_SIZE * 2);
+static constexpr auto ERASE_SIZE = BLOCK_SIZE;
+static constexpr auto N_WINDOWS = 1;
+static constexpr auto WINDOW_SIZE = BLOCK_SIZE;
+static constexpr auto PNOR_SIZE = (BLOCK_SIZE * 4);
+
+static const uint8_t get_info[] = {0x02, 0x00, 0x02, 0x00, 0x00, 0x00,
+                                   0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                                   0x00, 0x00, 0x00, 0x00};
+
+/* Request access beyond the last (only) partition */
+static const uint8_t create_read_window[] = {0x04, 0x01, 0x03, 0x00, 0x01, 0x00,
+                                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                                             0x00, 0x00, 0x00, 0x00};
+
+static const uint8_t response[] = {0x04, 0x01, 0xfe, 0xff, 0x01, 0x00, 0x03,
+                                   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01};
+
+int main()
+{
+    namespace test = openpower::virtual_pnor::test;
+
+    struct mbox_context *ctx;
+    int rc;
+
+    system_set_reserved_size(MEM_SIZE);
+    system_set_mtd_sizes(PNOR_SIZE, ERASE_SIZE);
+
+    ctx = mbox_create_test_context(N_WINDOWS, WINDOW_SIZE);
+    test::VpnorRoot root(ctx, toc, BLOCK_SIZE);
+    vpnor_create_partition_table_from_path(ctx, root.ro().c_str());
+
+    rc = mbox_command_dispatch(ctx, get_info, sizeof(get_info));
+    assert(rc == 1);
+
+    rc = mbox_command_dispatch(ctx, create_read_window,
+                               sizeof(create_read_window));
+    assert(rc == 1);
+
+    rc = mbox_cmp(ctx, response, sizeof(response));
+    assert(rc == 0);
+
+    return 0;
+}