--- a/sys/netgraph7/bluetooth/hci/ng_hci_evnt.c	2026-10-19 22:05:16.884952617 +0000
+++ b/sys/netgraph7/bluetooth/hci/ng_hci_evnt.c	2026-10-19 22:05:21.560892520 +0000
@@ -888,6 +888,27 @@
 	ep = mtod(event, ng_hci_num_compl_pkts_ep *);
 	m_adj(event, sizeof(*ep));
 
+	/*
+	 * The event comes from the controller and must not be trusted.
+	 * Verify that the payload really contains num_con_handles
+	 * (connection_handle, num_completed_packets) pairs before the
+	 * loop below consumes 4 bytes per iteration with m_copydata().
+	 * A malformed event would otherwise walk past the end of the
+	 * mbuf chain and panic the kernel in m_copydata().
+	 */
+	if (event->m_pkthdr.len <
+	    ep->num_con_handles * (sizeof(h) + sizeof(p))) {
+		NG_HCI_ALERT(
+"%s: %s - invalid Number Of Completed Packets event, " \
+"num_con_handles=%d, payload=%d bytes\n",
+			__func__, NG_NODE_NAME(unit->node),
+			ep->num_con_handles, event->m_pkthdr.len);
+
+		NG_FREE_M(event);
+
+		return (EINVAL);
+	}
+
 	for (; ep->num_con_handles > 0; ep->num_con_handles --) {
 		/* Get connection handle */
 		m_copydata(event, 0, sizeof(h), &h);