diff --git a/sys/netgraph/socket/ng_socket.c b/sys/netgraph/socket/ng_socket.c
--- a/sys/netgraph/socket/ng_socket.c
+++ b/sys/netgraph/socket/ng_socket.c
@@ -253,6 +253,18 @@
 	xmsg = kmalloc(len + 1, M_NETGRAPH, M_WAITOK);
 	m_copydata(m, 0, len, xmsg);
 
+	/*
+	 * Reject undersized control messages: the header (version,
+	 * typecookie, cmd, ...) is dereferenced by the message handler
+	 * and would otherwise be read past the `len + 1` byte allocation.
+	 * (DF-0534)
+	 */
+	if (len < sizeof(struct ng_msghdr)) {
+		kfree(xmsg, M_NETGRAPH);
+		error = EINVAL;
+		goto release;
+	}
+
 	/* The callee will free the xmsg when done. The addr is our business. */
 	error = ng_send_msg(pcbp->sockdata->node,
 			    (struct ng_mesg *) xmsg, path, &resp);