diff --git a/sys/netgraph7/socket/ng_socket.c b/sys/netgraph7/socket/ng_socket.c
--- a/sys/netgraph7/socket/ng_socket.c
+++ b/sys/netgraph7/socket/ng_socket.c
@@ -261,7 +261,14 @@
 	msg = kmalloc(len + 1, M_NETGRAPH_MSG, M_WAITOK);
 	m_copydata(m, 0, len, msg);
 
-	if (msg->header.version != NG_VERSION) {
+	/*
+	 * Reject undersized control messages: the header fields below
+	 * (version, typecookie, cmd, ...) are dereferenced unconditionally
+	 * and would otherwise be read past the `len + 1` byte allocation.
+	 * (DF-0534)
+	 */
+	if (len < sizeof(struct ng_msghdr) ||
+	    msg->header.version != NG_VERSION) {
 		kfree(msg, M_NETGRAPH_MSG);
 		error = EINVAL;
 		goto release;