diff --git a/sys/netgraph7/socket/ng_socket.c b/sys/netgraph7/socket/ng_socket.c
--- a/sys/netgraph7/socket/ng_socket.c
+++ b/sys/netgraph7/socket/ng_socket.c
@@ -769,6 +769,19 @@
 	 */
 
 	sap = (struct sockaddr_ng *) nam;
+
+	/*
+	 * Require the address to be NUL-terminated within sa_len, the same
+	 * way ng_bind() does.  Without this, ng_address_path() ->
+	 * ng_path2noderef() does strncpy(fullpath, address, NG_PATHSIZ - 1)
+	 * which scans past the sa_len-byte M_SONAME allocation and performs a
+	 * kernel heap over-read.  Data sockets are unprivileged (ngd_attach
+	 * has no caps_priv_check), so this check must not be omitted here.
+	 * (DF-0536)
+	 */
+	if (sap->sg_len < 3 || sap->sg_data[sap->sg_len - 3] != '\0')
+		return (EINVAL);
+
 	/* The item will hold the node reference. */
 	item = ng_package_data(NULL, NG_WAITOK);