diff --git a/sys/netgraph7/tcpmss/ng_tcpmss.c b/sys/netgraph7/tcpmss/ng_tcpmss.c
--- a/sys/netgraph7/tcpmss/ng_tcpmss.c
+++ b/sys/netgraph7/tcpmss/ng_tcpmss.c
@@ -423,6 +423,8 @@
 		else if (*opt == TCPOPT_NOP)
 			optlen = 1;
 		else {
+			if (olen < 2)
+				break;
 			optlen = *(opt + 1);
 			if (optlen <= 0 || optlen > olen)
 				break;