diff --git a/sys/dev/netif/ath/ath/if_ath_spectral.c b/sys/dev/netif/ath/ath/if_ath_spectral.c
--- a/sys/dev/netif/ath/ath/if_ath_spectral.c
+++ b/sys/dev/netif/ath/ath/if_ath_spectral.c
@@ -224,6 +224,10 @@
 	switch (id) {
 		case SPECTRAL_CONTROL_GET_PARAMS:
 			memset(&peout, 0, sizeof(peout));
+			if (outdata != NULL && outsize < sizeof(HAL_SPECTRAL_PARAM)) {
+				error = EINVAL;
+				break;
+			}
 			outsize = sizeof(HAL_SPECTRAL_PARAM);
 			ath_hal_spectral_get_config(sc->sc_ah, &peout);
 			pe = (HAL_SPECTRAL_PARAM *) outdata;