diff --git a/sys/net/if_ethersubr.c b/sys/net/if_ethersubr.c
--- a/sys/net/if_ethersubr.c
+++ b/sys/net/if_ethersubr.c
@@ -924,10 +924,19 @@
 	} else
 		goto bad;
 
-	while (m->m_len <= hlen) {
+	/*
+	 * DF-0445: the loop below advances m = m->m_next without checking
+	 * for NULL.  If the mbuf chain terminates at exactly hlen bytes
+	 * (m_next == NULL on the last mbuf with m_len <= remaining hlen),
+	 * the next loop condition dereferences NULL -> page fault.
+	 * Add the NULL check; on a too-short chain bail to "bad" instead.
+	 */
+	while (m != NULL && m->m_len <= hlen) {
 		hlen -= m->m_len;
 		m = m->m_next;
 	}
+	if (m == NULL)
+		goto bad;
 	if (m->m_len < hlen + hdrsize) {
 		/*
 		 * ip header is not in a single mbuf.  this should not