diff --git a/sys/netgraph/socket/ng_socket.c b/sys/netgraph/socket/ng_socket.c
--- a/sys/netgraph/socket/ng_socket.c
+++ b/sys/netgraph/socket/ng_socket.c
@@ -655,6 +667,15 @@
 	/* Find the target (victim) and check it doesn't already have a data
 	 * socket. Also check it is a 'socket' type node. */
 	sap = (struct sockaddr_ng *) nam;
+
+	/*
+	 * Require NUL-termination within sa_len, like ng_bind(). ng_path2node()
+	 * otherwise strncpy()'s past the sa_len-byte M_SONAME allocation
+	 * (kernel heap over-read). Data sockets are unprivileged. (DF-0536)
+	 */
+	if (sap->sg_len < 3 || sap->sg_data[sap->sg_len - 3] != '\0')
+		return (EINVAL);
+
 	if ((error = ng_path2node(NULL, sap->sg_data, &farnode, NULL)))
 		return (error);