diff --git a/sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c b/sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c
--- a/sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c
+++ b/sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c
@@ -1650,6 +1650,10 @@
 				/* NOT REACHED */
 			}
 
+			if (qlen <= 0 || qlen > 65535) {
+				error = EINVAL;
+				goto done;
+			}
 			q->maxlen = qlen;
 			break;