diff --git a/sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c b/sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c
--- a/sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c
+++ b/sys/netproto/802_11/wlan_ccmp/ieee80211_crypto_ccmp.c
@@ -619,7 +619,10 @@
 			pos_next = mtod(m, uint8_t *);
 			len = min(data_len, AES_BLOCK_LEN);
 			space_next = len > space ? len - space : 0;
-			KASSERT(m->m_len >= space_next,
+			if (m->m_len < space_next) {
+				m_freem(m0);
+				return 0;
+			}
 				("not enough data in following buffer, "
 				"m_len %u need %u\n", m->m_len, space_next));