diff --git a/sys/netinet/tcp_output.c b/sys/netinet/tcp_output.c
--- a/sys/netinet/tcp_output.c
+++ b/sys/netinet/tcp_output.c
@@ -777,7 +777,7 @@
 		tcp_sack_fill_report(tp, opt, &optlen);
 
 #ifdef TCP_SIGNATURE
-	if (tp->t_flags & TF_SIGNATURE) {
+	if (tp->t_flags & TF_SIGNATURE && optlen + TCPOLEN_SIGNATURE + 2 <= TCP_MAXOLEN) {
 		int i;
 		u_char *bp;
 		/*