diff --git a/sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c b/sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c
--- a/sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c
+++ b/sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c
@@ -2517,8 +2517,10 @@
 	type = RFCOMM_MCC_TYPE(hdr->type);
 	length = RFCOMM_MCC_LENGTH(hdr->length);
 
-	/* Check MCC frame length */
-	if (sizeof(*hdr) + length != m0->m_pkthdr.len) {
+	/* Check MCC frame length and ensure handlers can safely read the
+	 * declared payload from the first mbuf without walking stale bytes. */
+	if (sizeof(*hdr) + length != m0->m_pkthdr.len ||
+	    m0->m_len < (int)(sizeof(*hdr) + length)) {
 		NG_BTSOCKET_RFCOMM_ERR(
 "%s: Invalid MCC frame length=%d, len=%d\n",
 			__func__, length, m0->m_pkthdr.len);