diff --git a/sys/net/pf/pf_norm.c b/sys/net/pf/pf_norm.c
--- a/sys/net/pf/pf_norm.c
+++ b/sys/net/pf/pf_norm.c
@@ -406,6 +406,7 @@
 			 frep->fr_ip->ip_hl * 4 - off;
 		if (precut >= ip_len)
 			goto drop_fragment;
+		precut &= ~0x7;	/* round down to 8-byte boundary */
 		m_adj(frent->fr_m, precut);
 		DPFPRINTF(("overlap -%d\n", precut));
 		/* Enforce 8 byte boundaries */