diff --git a/sys/net/ipfw3_nat/ip_fw3_nat.c b/sys/net/ipfw3_nat/ip_fw3_nat.c
--- a/sys/net/ipfw3_nat/ip_fw3_nat.c
+++ b/sys/net/ipfw3_nat/ip_fw3_nat.c
@@ -771,11 +771,19 @@
 {
 	struct netmsg_nat_add nat_add_msg, *msg;
 	struct ioc_nat *ioc;
+
+	if (sopt->sopt_valsize < sizeof(struct ioc_nat))
+		return (EINVAL);
+
 	msg = &nat_add_msg;
 
 	ioc = (struct ioc_nat *)(sopt->sopt_val);
 	sooptcopyin(sopt, &msg->ioc_nat, sopt->sopt_valsize,
 			sizeof(struct ioc_nat));
+
+	if (ioc->id < 1 || ioc->id > NAT_ID_MAX)
+		return (EINVAL);
+
 	netmsg_init(&msg->base, NULL, &curthread->td_msgport, 0,
 			nat_add_dispatch);
 	netisr_domsg(&msg->base, 0);
@@ -853,8 +861,15 @@
 {
 	struct netmsg_nat_del nat_del_msg, *msg;
 
+	if (sopt->sopt_valsize < sizeof(int))
+		return (EINVAL);
+
 	msg = &nat_del_msg;
 	msg->id = *((int *)sopt->sopt_val);
+
+	if (msg->id < 1 || msg->id > NAT_ID_MAX)
+		return (EINVAL);
+
 	netmsg_init(&msg->base, NULL, &curthread->td_msgport,
 			0, nat_del_dispatch);