diff --git a/sys/netgraph/netgraph/ng_base.c b/sys/netgraph/netgraph/ng_base.c
--- a/sys/netgraph/netgraph/ng_base.c
+++ b/sys/netgraph/netgraph/ng_base.c
@@ -1559,6 +1559,18 @@
 		if (argstype == NULL)
 			*ascii->data = '\0';
 		else {
+			/*
+			 * DF-0450: ng_string_unparse() and friends use
+			 * unbounded strlen() on the binary data; without a
+			 * NUL inside the user-supplied data area, that
+			 * strlen runs off the end of the kmalloc'd buffer
+			 * into adjacent kernel heap.  The check above
+			 * guarantees msg->header.arglen >= sizeof(*binary)
+			 * + binary->header.arglen, so binary->data[arglen]
+			 * lies inside our own allocation -- NUL-terminate
+			 * there to bound any subsequent strlen().
+			 */
+			((u_char *)binary->data)[binary->header.arglen] = '\0';
 			if ((error = ng_unparse(argstype,
 			    (u_char *)binary->data,
 			    ascii->data, bufSize)) != 0) {