diff --git a/sys/netproto/802_11/wlan/ieee80211_hwmp.c b/sys/netproto/802_11/wlan/ieee80211_hwmp.c
--- a/sys/netproto/802_11/wlan/ieee80211_hwmp.c
+++ b/sys/netproto/802_11/wlan/ieee80211_hwmp.c
@@ -332,6 +332,19 @@
 		    iefrm[2] & IEEE80211_MESHPREQ_FLAGS_AE ? "1" : "0");
 		return (-1);
 	}
+	/*
+	 * A PREQ must carry at least one target; ndest==0 makes the
+	 * downstream kmalloc sizeof(*preq)+(ndest-1)*sizeof(target)
+	 * wrap, and hwmp_recv_preq() unconditionally reads
+	 * preq_targets[0] past the shrunken allocation.
+	 */
+	if (ndest < 1) {
+		IEEE80211_DISCARD(vap,
+		    IEEE80211_MSG_ACTION | IEEE80211_MSG_HWMP,
+		    wh, NULL, "PREQ with %s",
+		    "zero targets");
+		return (-1);
+	}
 	return ndest;
 }