diff --git a/sys/netgraph/netgraph/ng_base.c b/sys/netgraph/netgraph/ng_base.c
--- a/sys/netgraph/netgraph/ng_base.c
+++ b/sys/netgraph/netgraph/ng_base.c
@@ -1517,6 +1517,7 @@
 			error = EINVAL;
 			break;
 		}
+		/* XXX: arglen not validated against argstype struct size (DF-0379) */
 
 		/* Get a response message with lots of room */
 		NG_MKRESPONSE(rp, msg, sizeof(*ascii) + bufSize, M_NOWAIT);