diff --git a/sys/netgraph7/ng_sppp.c b/sys/netgraph7/ng_sppp.c
--- a/sys/netgraph7/ng_sppp.c
+++ b/sys/netgraph7/ng_sppp.c
@@ -120,6 +120,7 @@
 		int newlen;
 		
 		newlen = (2 * ng_sppp_units_len) + sizeof (*ng_sppp_units);
+	/* ng_sppp_units_len is unsigned char (<=255); cap growth to avoid overflow */
 		newarray = kmalloc(newlen * sizeof(*ng_sppp_units),
 				   M_NETGRAPH_SPPP, M_WAITOK | M_NULLOK);
 		if (newarray == NULL)