diff --git a/sys/netproto/802_11/wlan/ieee80211_ioctl.c b/sys/netproto/802_11/wlan/ieee80211_ioctl.c
--- a/sys/netproto/802_11/wlan/ieee80211_ioctl.c
+++ b/sys/netproto/802_11/wlan/ieee80211_ioctl.c
@@ -2321,6 +2321,15 @@
 	/* validate data is present as best we can */
 	if (space == 0 || 2+ie[1] > space)
 		return;
+	/*
+	 * Frame constructors (ieee80211_add_wpa/add_rsn -> add_ie) reserve
+	 * only sizeof(struct ieee80211_ie_wpa) bytes and write 2+ie[1] of it.
+	 * Reject any IE whose length byte would overflow that fixed slot,
+	 * otherwise add_ie()'s memcpy() runs off the end of the mbuf data
+	 * area (up to ~924 bytes of attacker-controlled OOB write).
+	 */
+	if (ie[1] > sizeof(struct ieee80211_ie_wpa) - 2)
+		return;
 	if (ie[0] == IEEE80211_ELEMID_VENDOR)
 		vap->iv_wpa_ie = ie;
 	else if (ie[0] == IEEE80211_ELEMID_RSN)