diff --git a/sys/netproto/802_11/wlan/ieee80211_ioctl.c b/sys/netproto/802_11/wlan/ieee80211_ioctl.c
--- a/sys/netproto/802_11/wlan/ieee80211_ioctl.c
+++ b/sys/netproto/802_11/wlan/ieee80211_ioctl.c
@@ -2382,6 +2382,10 @@
 
 				/* XXX ie length validate is painful, cheat */
 				setwparsnie(vap, data, appie->ie_len);
+				if (2 + data[1] > appie->ie_len) {
+					error = EINVAL;
+					break;
+				}
 				setwparsnie(vap, data + 2 + data[1],
 				    appie->ie_len - (2 + data[1]));
 			}