diff --git a/sys/netgraph7/ng_nat.c b/sys/netgraph7/ng_nat.c
--- a/sys/netgraph7/ng_nat.c
+++ b/sys/netgraph7/ng_nat.c
@@ -642,15 +642,31 @@
 			break;
 		case NGM_NAT_PROXY_RULE:
 		    {
-			char *cmd = (char *)msg->data;
+			char *cmd;
 
 			if (msg->header.arglen < 6) {
 				error = EINVAL;
 				break;
 			}
 
+			/*
+			 * LibAliasProxyRule() takes a C string.  The wire
+			 * buffer is not guaranteed to contain a NUL within
+			 * arglen bytes, so copy + terminate our own.
+			 */
+			cmd = kmalloc(msg->header.arglen + 1, M_NETGRAPH,
+			    M_WAITOK | M_NULLOK | M_ZERO);
+			if (cmd == NULL) {
+				error = ENOMEM;
+				break;
+			}
+			bcopy(msg->data, cmd, msg->header.arglen);
+			cmd[msg->header.arglen] = '\0';
+
 			if (LibAliasProxyRule(priv->lib, cmd) != 0)
 				error = ENOMEM;
+
+			kfree(cmd, M_NETGRAPH);
 		    }
 			break;
 		default: