diff --git a/sys/netgraph/pppoe/ng_pppoe.c b/sys/netgraph/pppoe/ng_pppoe.c
--- a/sys/netgraph/pppoe/ng_pppoe.c
+++ b/sys/netgraph/pppoe/ng_pppoe.c
@@ -967,6 +967,14 @@
 				LEAVE(EMSGSIZE);
 			}
 
+
+			/*
+			 * DF-0457: Validate ph->length vs actual mbuf payload
+			 * to prevent OOB tag-walk in get_tag()/scan_tags().
+			 */
+			if (ntohs(wh->ph.length) > m->m_pkthdr.len - sizeof(*wh))
+				LEAVE(EMSGSIZE);
+
 			switch(code) {
 			case	PADI_CODE:
 				/*