diff --git a/sys/dev/netif/iwm/if_iwm_time_event.c b/sys/dev/netif/iwm/if_iwm_time_event.c
--- a/sys/dev/netif/iwm/if_iwm_time_event.c
+++ b/sys/dev/netif/iwm/if_iwm_time_event.c
@@ -203,12 +203,18 @@
 /*
  * The Rx handler for time event notifications
  */
-void
-iwm_rx_time_event_notif(struct iwm_softc *sc, struct iwm_rx_packet *pkt)
-{
-	struct iwm_time_event_notif *notif = (void *)pkt->data;
-
-	IWM_DPRINTF(sc, IWM_DEBUG_TE,
+void
+iwm_rx_time_event_notif(struct iwm_softc *sc, struct iwm_rx_packet *pkt)
+{
+	struct iwm_time_event_notif *notif = (void *)pkt->data;
+
+	if (iwm_rx_packet_payload_len(pkt) < sizeof(*notif)) {
+		IWM_DPRINTF(sc, IWM_DEBUG_TE,
+		    "short time event notif\n");
+		return;
+	}
+
+	IWM_DPRINTF(sc, IWM_DEBUG_TE,
 	    "Time event notification - UID = 0x%x action %d\n",
 	    le32toh(notif->unique_id),
 	    le32toh(notif->action));