diff --git a/sys/netproto/802_11/wlan/ieee80211_input.c b/sys/netproto/802_11/wlan/ieee80211_input.c
--- a/sys/netproto/802_11/wlan/ieee80211_input.c
+++ b/sys/netproto/802_11/wlan/ieee80211_input.c
@@ -417,8 +417,15 @@
 	struct ieee80211_rateset *rs = &ni->ni_rates;
 
 	memset(rs, 0, sizeof(*rs));
-	rs->rs_nrates = rates[1];
-	memcpy(rs->rs_rates, rates + 2, rs->rs_nrates);
+	int nrates = rates[1];
+	if (nrates > IEEE80211_RATE_MAXSIZE) {
+		IEEE80211_DISCARD(vap, IEEE80211_MSG_ELEMID, NULL, NULL,
+		    "%s", "rate set too large");
+		vap->iv_stats.is_rx_elem_toobig++;
+		nrates = IEEE80211_RATE_MAXSIZE;
+	}
+	rs->rs_nrates = (uint8_t)nrates;
+	memcpy(rs->rs_rates, rates + 2, nrates);
 	if (xrates != NULL) {
 		uint8_t nxrates;
 		/*