diff --git a/sys/netgraph/fec/ng_fec.c b/sys/netgraph/fec/ng_fec.c
@@ -1009,6 +1009,19 @@
 
 	BPF_MTAP(ifp, m0);
 
+	/*
+	 * Ensure the head of the mbuf chain is contiguous and long enough
+	 * to cover the ethernet + IP headers that ng_fec_choose_port() will
+	 * dereference.  Without this, a short or fragmented mbuf can cause
+	 * an out-of-bounds read past m_data.
+	 */
+	m0 = m_pullup(m0, sizeof(struct ether_header) + sizeof(struct ip));
+	if (m0 == NULL) {
+		IFNET_STAT_INC(ifp, ierrors, 1);
+		priv->if_error = ENOBUFS;
+		return;
+	}
+
 	/* Queue up packet on the proper port. */
 	error = ng_fec_choose_port(b, m0, &oifp);
 	if (error) {