diff --git a/sys/net/pf/pf.c b/sys/net/pf/pf.c
--- a/sys/net/pf/pf.c
+++ b/sys/net/pf/pf.c
@@ -6620,7 +6620,11 @@
 			log = action != PF_PASS;
 			goto done;
 		}
-		pd.p_len = pd.tot_len - off - (th.th_off << 2);
+		{ int _optlen = (th.th_off << 2);
+		  if (_optlen > pd.tot_len - off)
+			  pd.p_len = 0;
+		  else
+			  pd.p_len = pd.tot_len - off - _optlen; }
 #ifdef ALTQ
 		if ((th.th_flags & TH_ACK) && pd.p_len == 0)
 			pqid = 1;
@@ -7021,7 +7025,11 @@
 			log = action != PF_PASS;
 			goto done;
 		}
-		pd.p_len = pd.tot_len - off - (th.th_off << 2);
+		{ int _optlen = (th.th_off << 2);
+		  if (_optlen > pd.tot_len - off)
+			  pd.p_len = 0;
+		  else
+			  pd.p_len = pd.tot_len - off - _optlen; }
 		action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd);
 		if (action == PF_DROP)
 			goto done;