diff --git a/sys/netgraph7/bluetooth/l2cap/ng_l2cap_ulpi.c b/sys/netgraph7/bluetooth/l2cap/ng_l2cap_ulpi.c
--- a/sys/netgraph7/bluetooth/l2cap/ng_l2cap_ulpi.c
+++ b/sys/netgraph7/bluetooth/l2cap/ng_l2cap_ulpi.c
@@ -1320,6 +1320,18 @@
 		error = EMSGSIZE;
 		goto out;
 	}
+	/* DF-0458: verify the message actually carries the echo data it
+	 * claims to carry. Without this check, a message with arglen==8
+	 * but echo_size==65531 makes _ng_l2cap_echo_req / m_copyback read
+	 * up to 65531 bytes past msg->data+8 into kernel heap. */
+	if (msg->header.arglen < sizeof(*ip) + ip->echo_size) {
+		NG_L2CAP_ALERT(
+"%s: %s - invalid L2CA_Ping request. arglen %d < sizeof(ip) %zu + echo_size %u\n",
+			__func__, NG_NODE_NAME(l2cap->node),
+			msg->header.arglen, sizeof(*ip), ip->echo_size);
+		error = EMSGSIZE;
+		goto out;
+	}
 
 	/* Check if we have connection to the unit */
 	con = ng_l2cap_con_by_addr(l2cap, &ip->bdaddr);