diff --git a/sys/netgraph7/ng_tag.c b/sys/netgraph7/ng_tag.c
--- a/sys/netgraph7/ng_tag.c
+++ b/sys/netgraph7/ng_tag.c
@@ -533,8 +533,9 @@
 	 */
 	if ((cookie != 0) || (type != 0)) {
 		tag = m_tag_locate(m, cookie, type, NULL);
 		while (tag != NULL) {
-			if (memcmp((void *)(tag + 1),
-			    hip->in_tag_data, tag_len) == 0) {
+			/* m_tag_locate matches by (cookie,type) only, so the
+			 * located tag's data area may be shorter than our
+			 * configured tag_len. Bound the memcmp by the tag's
+			 * actual m_tag_len to avoid a heap OOB read (DF-0634). */
+			if (tag->m_tag_len == tag_len &&
+			    memcmp((void *)(tag + 1),
+			    hip->in_tag_data, tag_len) == 0) {
 				found = 1;
 				break;
 			}