diff --git a/sys/netinet6/ip6_mroute.c b/sys/netinet6/ip6_mroute.c
--- a/sys/netinet6/ip6_mroute.c
+++ b/sys/netinet6/ip6_mroute.c
@@ -285,7 +285,10 @@
 		error = ip6_mrouter_done();
 		break;
 	case MRT6_ADD_MIF:
-		error = add_m6if(mtod(m, struct mif6ctl *));
+		if (m->m_len < sizeof(struct mif6ctl))
+			error = EINVAL;
+		else
+			error = add_m6if(mtod(m, struct mif6ctl *));
 		break;
 	case MRT6_DEL_MIF:
 		error = del_m6if(mtod(m, mifi_t *));