diff --git a/sys/netinet6/in6.c b/sys/netinet6/in6.c
--- a/sys/netinet6/in6.c
+++ b/sys/netinet6/in6.c
@@ -562,7 +562,10 @@
 				/* Link ID is not embedded by the user */
 				sa6->sin6_addr.s6_addr16[1] =
 				    htons(ifp->if_index);
-			} else if (sa6->sin6_addr.s6_addr16[1] !=
+			} else if (sa6->sin6_addr.s6_addr16[1] != 0 &&
+			   ntohs(sa6->sin6_addr.s6_addr16[1]) >= if_index) {
+			return (ENXIO);	/* bogus zone id: avoid OOB ifindex2ifnet[] read */
+		} else if (sa6->sin6_addr.s6_addr16[1] !=
 			    htons(ifp->if_index)) {
 				/* Link ID contradicts */
 				return (EINVAL);