diff --git a/src/devices/waveman.c b/src/devices/waveman.c
index faa35038..83c5822e 100644
--- a/src/devices/waveman.c
+++ b/src/devices/waveman.c
@@ -62,6 +62,14 @@ static int waveman_callback(r_device *decoder, bitbuffer_t *bitbuffer)
                 | ((b[i] & 0x01) ? 0x00 : 0x08);
     }
 
+    // Only 0xe (ON) and 0x6 (OFF) are valid states in real captures; any other
+    // value was previously still accepted and reported as "OFF", silently
+    // letting 14 of 16 possible nibble values through as a false decode.
+    if (nb[2] != 0xe && nb[2] != 0x6) {
+        decoder_logf(decoder, 2, __func__, "implausible state nibble: %x", nb[2]);
+        return DECODE_FAIL_SANITY;
+    }
+
     id_str[0] = 'A' + nb[0];
     id_str[1] = '\0';