diff --git a/sys/netgraph7/bluetooth/l2cap/ng_l2cap_ulpi.c b/sys/netgraph7/bluetooth/l2cap/ng_l2cap_ulpi.c
--- a/sys/netgraph7/bluetooth/l2cap/ng_l2cap_ulpi.c
+++ b/sys/netgraph7/bluetooth/l2cap/ng_l2cap_ulpi.c
@@ -1321,6 +1321,24 @@
 		goto out;
 	}
 
+	/*
+	 * Verify that the message actually contains the claimed echo data.
+	 * Without this check, _ng_l2cap_echo_req's m_copyback would read past
+	 * the end of msg->data into adjacent kernel heap (CWE-125 OOB read),
+	 * whose contents would then be transmitted as the L2CAP Echo Request
+	 * payload to the remote Bluetooth peer (kernel heap info leak).
+	 * Mirrors the exact-match pattern in ng_l2cap_l2ca_get_info_req().
+	 */
+	if (msg->header.arglen != sizeof(*ip) + ip->echo_size) {
+		NG_L2CAP_ALERT(
+"%s: %s - L2CA_Ping echo_size does not match message size, "
+"arglen=%d, expected=%zd\n",
+			__func__, NG_NODE_NAME(l2cap->node),
+			msg->header.arglen, sizeof(*ip) + ip->echo_size);
+		error = EMSGSIZE;
+		goto out;
+	}
+
 	/* Check if we have connection to the unit */
 	con = ng_l2cap_con_by_addr(l2cap, &ip->bdaddr);
 	if (con == NULL) {