diff --git a/sys/netproto/smb/smb_rq.c b/sys/netproto/smb/smb_rq.c
--- a/sys/netproto/smb/smb_rq.c
+++ b/sys/netproto/smb/smb_rq.c
@@ -433,6 +433,19 @@
 	for(len = 0, m = m0; m->m_next; m = m->m_next)
 		len += m->m_len;
 	len += m->m_len;
+	/*
+	 * 'count' is an attacker-controlled TRANS2 DataCount/ParameterCount
+	 * taken verbatim from the server response.  It must not exceed the
+	 * actual bytes available in the mbuf chain from 'offset'; otherwise
+	 * the subtraction below wraps and inflates m->m_len, corrupting the
+	 * chain.  A malicious server sending count > len then causes
+	 * md_get_mem() to read past the mbuf into adjacent kernel memory
+	 * (info leak) and trips an mbuf overflow panic on free.
+	 */
+	if (count > len) {
+		m_freem(m0);
+		return EBADRPC;
+	}
 	m->m_len -= len - count;
 	if (mdp->md_top == NULL) {
 		md_initm(mdp, m0);