diff --git a/sys/net/pf/pf_ioctl.c b/sys/net/pf/pf_ioctl.c
--- a/sys/net/pf/pf_ioctl.c
+++ b/sys/net/pf/pf_ioctl.c
@@ -939,7 +939,8 @@
 			kfree(rs->rules[rs_cnt].inactive.ptr_array, M_TEMP);
 		rs->rules[rs_cnt].inactive.ptr_array = NULL;
 
-		if (rs->rules[rs_cnt].inactive.rcount) {
+		if (rs->rules[rs_cnt].inactive.rcount &&
+		    rs->rules[rs_cnt].inactive.rcount <= 65535) {
 			rs->rules[rs_cnt].inactive.ptr_array =
 			    kmalloc(sizeof(caddr_t) *
 				    rs->rules[rs_cnt].inactive.rcount,