diff --git a/sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c b/sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c
--- a/sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c
+++ b/sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap_raw.c
@@ -1073,6 +1073,10 @@
 			error = EINVAL;
 			break;
 		}
+		if (p->info_size > NG_L2CAP_MAX_ECHO_SIZE) {
+			error = EINVAL;
+			break;
+		}
 
 		NG_MKMESSAGE(ngmsg, NGM_L2CAP_COOKIE,
 			NGM_L2CAP_L2CA_GET_INFO, sizeof(*ip) + p->info_size,