diff --git a/sys/netgraph/lmi/ng_lmi.c b/sys/netgraph/lmi/ng_lmi.c
--- a/sys/netgraph/lmi/ng_lmi.c
+++ b/sys/netgraph/lmi/ng_lmi.c
@@ -759,6 +759,17 @@
 
 	packetlen = m->m_hdr.mh_len;
 	data = mtod(m, const u_char *);
+	/*
+	 * Enforce the minimum LMI frame length that the fixed-header
+	 * parsing below assumes (LMI_MIN_LENGTH). Without this guard,
+	 * a short frame causes STEPBY() to underflow `packetlen`
+	 * (u_short 0 -> 0xFFFF) and the IE loop then reads adjacent
+	 * kernel heap.
+	 */
+	if (packetlen < LMI_MIN_LENGTH) {
+		log(LOG_WARNING, "nglmi: too short (%u)\n", packetlen);
+		goto reject;
+	}
 	if (*data != 0x03) {
 		log(LOG_WARNING, "nglmi: unexpected value in LMI(%d)\n", 1);
 		goto reject;