diff --git a/sys/netinet6/raw_ip6.c b/sys/netinet6/raw_ip6.c
--- a/sys/netinet6/raw_ip6.c
+++ b/sys/netinet6/raw_ip6.c
@@ -400,6 +400,10 @@
 			off = offsetof(struct icmp6_hdr, icmp6_cksum);
 		else
 			off = in6p->in6p_cksum;
+		if (off < 0 || (off % 2) != 0 || off > plen) {
+			error = EINVAL;
+			goto bad;
+		}
 		if (plen < off + 1) {
 			error = EINVAL;
 			goto bad;