diff --git a/sys/net/ipfw3_basic/ip_fw3_sync.c b/sys/net/ipfw3_basic/ip_fw3_sync.c
--- a/sys/net/ipfw3_basic/ip_fw3_sync.c
+++ b/sys/net/ipfw3_basic/ip_fw3_sync.c
@@ -140,6 +140,11 @@
 	int size;
 
 	ioc_centre = sopt->sopt_val;
+	/* DF-0700: count is user-controlled and indexes centre_socks[MAX_EDGES];
+	   reject out-of-range so centre_start/test/stop/send_state/MOD_UNLOAD
+	   cannot index past fw3_sync_ctx.centre_socks[] into adjacent BSS. */
+	if (ioc_centre->count < 0 || ioc_centre->count > MAX_EDGES)
+		return EINVAL;
 	size = ioc_centre->count * LEN_SYNC_EDGE;
 	if (fw3_sync_ctx.count == 0) {
 		fw3_sync_ctx.edges = kmalloc(size, M_IPFW3_SYNC, M_NOWAIT | M_ZERO);