--- a/sys/dev/netif/mn/if_mn.c
+++ b/sys/dev/netif/mn/if_mn.c
@@ -359,6 +359,10 @@
 	if (msg->header.arglen)
 		s = (char *)msg->data;
 	else
+		s = NULL;
+	/* Require NUL termination within arglen. */
+	if (s != NULL && msg->header.arglen > 0 &&
+	    s[msg->header.arglen - 1] != '\0')
 		s = NULL;
 	r = (char *)(*resp)->data;
 	*r = '\0';