diff --git a/sys/net/ipfw3/ip_fw3.c b/sys/net/ipfw3/ip_fw3.c
--- a/sys/net/ipfw3/ip_fw3.c
+++ b/sys/net/ipfw3/ip_fw3.c
@@ -202,6 +202,8 @@
 			len -= cmdlen,
 			cmd = (ipfw_insn *)((uint32_t *)cmd + cmdlen)) {
 			cmdlen = F_LEN(cmd);
+			if (cmdlen == 0)	/* DF-0474: avoid infinite loop */
+				break;
 			if (cmd->module == 0 &&
 				(cmd->opcode == 0 || cmd->opcode == 1)) {
 				//action accept or deny
@@ -493,6 +495,8 @@
 		for (l = f->cmd_len, cmd = f->cmd; l > 0; l -= cmdlen,
 			cmd = (ipfw_insn *)((uint32_t *)cmd+ cmdlen)) {
 			cmdlen = F_LEN(cmd);
+			if (cmdlen == 0)	/* DF-0474: avoid infinite loop */
+				break;
 
 			/* skip 'or' filter when already match */
 			if (cmd->len & F_OR &&