diff --git a/sys/net/ipfw3_basic/ip_fw3_sync.c b/sys/net/ipfw3_basic/ip_fw3_sync.c
--- a/sys/net/ipfw3_basic/ip_fw3_sync.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/net/ipfw3_basic/ip_fw3_sync.c	2026-07-19 07:48:16.815287453 +0000
@@ -206,13 +206,26 @@
 		if (error)
 			break;
 		m = sio.sb_mb;
+		if (m == NULL || m->m_len < sizeof(int)) {
+			/* DF-0704: drop datagrams too small for a type field */
+			kprintf("ipfw3sync: ignore short datagram\n");
+			continue;
+		}
 		type = (int *)m->m_data;
 		if (*type == SYNC_TYPE_SEND_TEST) {
 			struct cmd_send_test *cmd;
+			if (m->m_len < sizeof(*cmd)) {
+				kprintf("ipfw3sync: short SEND_TEST\n");
+				continue;
+			}
 			cmd = (struct cmd_send_test *)m->m_data;
 			kprintf("test received %d\n", cmd->num);
 		} else if (*type == SYNC_TYPE_SEND_STATE) {
 			struct cmd_send_state *cmd;
+			if (m->m_len < sizeof(*cmd)) {
+				kprintf("ipfw3sync: short SEND_STATE\n");
+				continue;
+			}
 			cmd = (struct cmd_send_state *)m->m_data;
 			if (ipfw_sync_install_state_prt != NULL) {
 				(*ipfw_sync_install_state_prt)(cmd);