diff --git a/sys/netgraph7/bluetooth/l2cap/ng_l2cap_evnt.c b/sys/netgraph7/bluetooth/l2cap/ng_l2cap_evnt.c
--- a/sys/netgraph7/bluetooth/l2cap/ng_l2cap_evnt.c
+++ b/sys/netgraph7/bluetooth/l2cap/ng_l2cap_evnt.c
@@ -199,6 +199,7 @@
 		/* Process command */
 		switch (hdr->code) {
 		case NG_L2CAP_CMD_REJ:
+			/* require the full reject payload to avoid a short/uninitialized read */
 			ng_l2cap_process_cmd_rej(con, hdr->ident);
 			break;