diff --git a/sys/netgraph7/ng_fec.c b/sys/netgraph7/ng_fec.c
--- a/sys/netgraph7/ng_fec.c
+++ b/sys/netgraph7/ng_fec.c
@@ -1015,6 +1015,8 @@
 	 * but the last 2 bits.
 	 */
 	mask = b->fec_ifcnt == 2 ? 0x1 : 0x3;
+	if (m->m_pkthdr.len < sizeof(struct ether_header))
+		return (EINVAL);
 	eh = mtod(m, struct ether_header *);
 #ifdef INET
 	ip = (struct ip *)(mtod(m, char *) +