diff --git a/sys/netproto/802_11/wlan_wep/ieee80211_crypto_wep.c b/sys/netproto/802_11/wlan_wep/ieee80211_crypto_wep.c
--- a/sys/netproto/802_11/wlan_wep/ieee80211_crypto_wep.c
+++ b/sys/netproto/802_11/wlan_wep/ieee80211_crypto_wep.c
@@ -484,7 +484,11 @@
 		i = (i + 1) & 0xff;
 		j = (j + S[i]) & 0xff;
 		S_SWAP(i, j);
-		/* XXX assumes ICV is contiguous in mbuf */
+		/* ICV must be contiguous in the current mbuf */
+		if (pos >= mtod(m, uint8_t *) + m->m_len) {
+			m_freem(m);
+			return 0;
+		}
 		if ((icv[k] ^ S[(S[i] + S[j]) & 0xff]) != *pos++) {
 			/* ICV mismatch - drop frame */
 			return 0;