diff --git a/sys/netgraph7/bluetooth/hci/ng_hci_evnt.c b/sys/netgraph7/bluetooth/hci/ng_hci_evnt.c
--- a/sys/netgraph7/bluetooth/hci/ng_hci_evnt.c
+++ b/sys/netgraph7/bluetooth/hci/ng_hci_evnt.c
@@ -888,7 +888,16 @@
 	ep = mtod(event, ng_hci_num_compl_pkts_ep *);
 	m_adj(event, sizeof(*ep));
 
-	for (; ep->num_con_handles > 0; ep->num_con_handles --) {
+	/*
+	 * Each entry consumes sizeof(h) + sizeof(p) bytes from the mbuf.  The
+	 * remote controller-supplied num_con_handles is not trusted; stop as
+	 * soon as the remaining mbuf cannot hold a full entry, otherwise
+	 * m_copydata() will read past the exhausted chain (KASSERT/NULL-deref
+	 * panic).
+	 */
+	for (; ep->num_con_handles > 0 &&
+		   event->m_pkthdr.len >= (sizeof(h) + sizeof(p));
+	     ep->num_con_handles --) {
 		/* Get connection handle */
 		m_copydata(event, 0, sizeof(h), &h);
 		m_adj(event, sizeof(h));