--- a/sys/netgraph7/ng_pred1.c
+++ b/sys/netgraph7/ng_pred1.c
@@ ng_pred1_decompress @@
 	inlen = m->m_pkthdr.len;
 
+	if (inlen < 4) {			/* 2 hdr + 2 FCS minimum */
+		priv->stats.Errors++;
+		NG_FREE_M(m);
+		return (ENOMEM);
+	}
 	if (inlen > PRED1_BUF_SIZE) {