diff --git a/sys/net/ipfw3_basic/ip_fw3_basic.c b/sys/net/ipfw3_basic/ip_fw3_basic.c
--- a/sys/net/ipfw3_basic/ip_fw3_basic.c
+++ b/sys/net/ipfw3_basic/ip_fw3_basic.c
@@ -213,7 +213,7 @@
 	sa = &((ipfw_insn_sa *)cmd)->sa;
 	/* arg3: count of the dest, arg1: type of fwd */
 	int i = 0;
-	if(cmd->arg3 > 1) {
+	if(cmd->arg3 > 1 && cmd->arg3 <= (cmd->len * 4) / sizeof(struct sockaddr_in)) {
 		if (cmd->arg1 == 0) {		/* type: random */
 			i = krandom() % cmd->arg3;
 		} else if (cmd->arg1 == 1) {	/* type: round-robin */