diff --git a/sys/net/ipfw3_basic/ip_fw3_log.c b/sys/net/ipfw3_basic/ip_fw3_log.c
index 0000000..1111111 100644
--- a/sys/net/ipfw3_basic/ip_fw3_log.c
+++ b/sys/net/ipfw3_basic/ip_fw3_log.c
@@ -113,6 +113,19 @@
 void
 ip_fw3_log(struct mbuf *m, struct ether_header *eh, uint16_t id)
 {
+
+	/*
+	 * DF-0748: id flows from cmd->arg1 (uint16_t) which is set by the
+	 * ipfw3 CLI `log N` via strtoul with NO validation
+	 * (sbin/ipfw3/ipfw3basic.c:93,110) and is bcopy verbatim into the
+	 * kernel rule. Without this guard, id >= LOG_IF_MAX drives an OOB
+	 * read of log_if_table[] (10 entries), yielding a garbage pointer
+	 * dereferenced at if_bpf (offset 16) => kernel panic / corruption.
+	 */
+	if (id >= LOG_IF_MAX) {
+		return;
+	}
+
 	struct ifnet *the_if = NULL;
 
 	if (sysctl_var_fw3_verbose) {