diff --git a/sys/netproto/802_11/wlan/ieee80211_scan.c b/sys/netproto/802_11/wlan/ieee80211_scan.c
--- a/sys/netproto/802_11/wlan/ieee80211_scan.c
+++ b/sys/netproto/802_11/wlan/ieee80211_scan.c
@@ -295,7 +295,7 @@
 ieee80211_scan_copy_ssid(struct ieee80211vap *vap, struct ieee80211_scan_state *ss,
 	int nssid, const struct ieee80211_scan_ssid ssids[])
 {
-	if (nssid > IEEE80211_SCAN_MAX_SSID) {
+	if (nssid < 0 || nssid > IEEE80211_SCAN_MAX_SSID) {
 		/* XXX printf */
 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_SCAN,
 		    "%s: too many ssid %d, ignoring all of them\n",