diff --git a/sys/net/ipfw3/ip_fw3_set.c b/sys/net/ipfw3/ip_fw3_set.c
index 0000000..1111111 100644
--- a/sys/net/ipfw3/ip_fw3_set.c
+++ b/sys/net/ipfw3/ip_fw3_set.c
@@ -210,7 +210,16 @@
 
 	ctx = fw3_ctx[mycpuid];
 
-	bcopy(&ctx->sets, sopt->sopt_val, sopt->sopt_valsize);
+	/*
+	 * ctx->sets is a single uint32_t (the LAST field of
+	 * struct ipfw3_context).  Only copy out those 4 bytes; using the
+	 * attacker-controlled sopt->sopt_valsize directly reads kernel heap
+	 * past the allocation and discloses it to userspace.
+	 */
+	if (sopt->sopt_valsize < sizeof(ctx->sets))
+		return (EINVAL);
+	sopt->sopt_valsize = sizeof(ctx->sets);
+	bcopy(&ctx->sets, sopt->sopt_val, sizeof(ctx->sets));
 	return 0;
 }