diff --git a/src/sev.rs b/src/sev.rs
index d52294c..126c5f0 100644
--- a/src/sev.rs
+++ b/src/sev.rs
@@ -17,6 +17,7 @@ enum SnpOid {
     Tee,
     Snp,
     Ucode,
+    Fmc,
     HwId,
 }
 
@@ -27,6 +28,7 @@ impl SnpOid {
             SnpOid::Tee => oid!(1.3.6.1.4.1.3704.1.3.2),
             SnpOid::Snp => oid!(1.3.6.1.4.1.3704.1.3.3),
             SnpOid::Ucode => oid!(1.3.6.1.4.1.3704.1.3.8),
+            SnpOid::Fmc => oid!(1.3.6.1.4.1.3704.1.3.9),
             SnpOid::HwId => oid!(1.3.6.1.4.1.3704.1.4),
         }
     }
@@ -223,6 +225,20 @@ fn verify_tcb(vcek: &Certificate, report: &AttestationReport, opts: &VerifyOptio
         }
     }
 
+    if let Some(fmc) = report.reported_tcb.fmc {
+        if let Some(ext) = extensions.get(&SnpOid::Fmc.oid()) {
+            if !check_cert_extension(ext, &fmc.to_le_bytes()) {
+                return Err(anyhow::anyhow!(
+                    "TCB FMC mismatch: report={} vs certificate",
+                    fmc
+                ));
+            }
+            if !opts.quiet {
+                println!("TCB FMC matches ({})", fmc);
+            }
+        }
+    }
+
     if let Some(ext) = extensions.get(&SnpOid::HwId.oid()) {
         if !check_cert_extension(ext, &report.chip_id) {
             return Err(anyhow::anyhow!("Chip ID mismatch between report and VCEK"));