diff --git a/sys/net/bpf.c b/sys/net/bpf.c
--- a/sys/net/bpf.c
+++ b/sys/net/bpf.c
@@ -263,7 +263,7 @@
 			 */
 			p = mtod(m, const struct ieee80211_bpf_params *);
 			hlen = p->ibp_len;
-			if (hlen > sizeof(sockp->sa_data)) {
+			if (hlen > m->m_len || hlen > (int)sizeof(sockp->sa_data)) {
 				error = EINVAL;
 				goto bad;
 			}