--- a/sys/net/ipfw3_basic/ip_fw3_table.c
+++ b/sys/net/ipfw3_basic/ip_fw3_table.c
@@ -159,9 +159,16 @@
                 if (ent == NULL)
                         return;
                 mlen = ioc_tbl->ip_ent->masklen;
+                if (mlen > 32) {
+                        kfree(ent, M_IPFW3_TABLE);
+                        return;
+                }
                 ent->addr.sin_len = sizeof(ent->addr);
                 ent->mask.sin_len = sizeof(ent->mask);
-                ent->mask.sin_addr.s_addr = htonl(~((1 << (32 - mlen)) - 1));
+                if (mlen == 0)
+                        ent->mask.sin_addr.s_addr = 0;
+                else
+                        ent->mask.sin_addr.s_addr = htonl(~((1u << (32 - mlen)) - 1));
                 ent->addr.sin_addr.s_addr = ioc_tbl->ip_ent->addr &
                                                 ent->mask.sin_addr.s_addr;