diff --git a/sys/netproto/802_11/wlan/ieee80211_mesh.c b/sys/netproto/802_11/wlan/ieee80211_mesh.c
--- a/sys/netproto/802_11/wlan/ieee80211_mesh.c
+++ b/sys/netproto/802_11/wlan/ieee80211_mesh.c
@@ -2176,6 +2176,11 @@
 			mpie = (const struct ieee80211_meshpeer_ie *) frm;
 			memset(mp, 0, sizeof(*mp));
 			mp->peer_len = mpie->peer_len;
+			/* peer_len must cover the base peer-IE fields (peer_proto +
+			 * peer_llinkid) before we decode them; otherwise decoding
+			 * peer_linkid/peer_rcode below reads 2 bytes out of bounds. */
+			if (mp->peer_len < IEEE80211_MPM_BASE_SZ)
+				return NULL;
 			mp->peer_proto = le16dec(&mpie->peer_proto);
 			mp->peer_llinkid = le16dec(&mpie->peer_llinkid);
 			switch (subtype) {