diff --git a/sys/netproto/802_11/wlan/ieee80211_scan_sta.c b/sys/netproto/802_11/wlan/ieee80211_scan_sta.c
--- a/sys/netproto/802_11/wlan/ieee80211_scan_sta.c
+++ b/sys/netproto/802_11/wlan/ieee80211_scan_sta.c
@@ -308,8 +308,18 @@
 	ise->se_intval = sp->bintval;
 	ise->se_capinfo = sp->capinfo;
 #ifdef IEEE80211_SUPPORT_MESH
-	if (sp->meshid != NULL && sp->meshid[1] != 0)
-		memcpy(ise->se_meshid, sp->meshid, 2+sp->meshid[1]);
+	if (sp->meshid != NULL && sp->meshid[1] != 0) {
+		/* Bounds-check the Mesh ID length: se_meshid is only
+		 * 2+IEEE80211_MESHID_LEN (34) bytes but meshid[1] is an
+		 * attacker-controlled uint8_t that can reach 255, making
+		 * the copy 257 bytes (CVE-2022-23088 / FreeBSD-SA-22:07).
+		 * Truncate so the memcpy cannot overflow se_meshid into the
+		 * adjacent se_ies / se_age fields. */
+		uint8_t meshidlen = sp->meshid[1];
+		if (meshidlen > IEEE80211_MESHID_LEN)
+			meshidlen = IEEE80211_MESHID_LEN;
+		memcpy(ise->se_meshid, sp->meshid, 2 + meshidlen);
+	}
 #endif
 	/*
 	 * Beware of overriding se_chan for frames seen