diff --git a/sys/netgraph7/iface/ng_iface.c b/sys/netgraph7/iface/ng_iface.c
--- a/sys/netgraph7/iface/ng_iface.c
+++ b/sys/netgraph7/iface/ng_iface.c
@@ -424,10 +424,15 @@
 		return (ENETDOWN);
 	}
 
-	/* BPF writes need to be handled specially. */
+	/* BPF writes: read AF from mbuf (DLT_NULL convention), not sa_data. */
 	if (dst->sa_family == AF_UNSPEC) {
-		bcopy(dst->sa_data, &af, sizeof(af));
-		dst->sa_family = af;
+		if (m->m_pkthdr.len < sizeof(af)) {
+			m_freem(m);
+			return (EINVAL);
+		}
+		m_copydata(m, 0, sizeof(af), (caddr_t)&af);
+		m_adj(m, sizeof(af));
+		dst->sa_family = (sa_family_t)af;
 	}
 
 	/* Berkeley packet filter */