diff --git a/sys/net/ipfw/ip_fw2.c b/sys/net/ipfw/ip_fw2.c
--- a/sys/net/ipfw/ip_fw2.c
+++ b/sys/net/ipfw/ip_fw2.c
@@ -3322,6 +3322,8 @@
 		case IPPROTO_TCP:
 			PULLUP_TO(hlen + sizeof(struct tcphdr));
 			local->tcp = tcp = L3HDR(struct tcphdr, ip);
+			if (tcp->th_off > sizeof(struct tcphdr) / 4)
+				PULLUP_TO(hlen + (tcp->th_off << 2));
 			local->dst_port = tcp->th_dport;
 			local->src_port = tcp->th_sport;
 			args->f_id.flags = tcp->th_flags;