diff --git a/sys/net/ipfw3/ip_fw3_set.c b/sys/net/ipfw3/ip_fw3_set.c
--- a/sys/net/ipfw3/ip_fw3_set.c
+++ b/sys/net/ipfw3/ip_fw3_set.c
@@ -210,6 +210,10 @@
 
 	ctx = fw3_ctx[mycpuid];
 
+	/* DF-2592: ctx->sets is a single uint32_t; never copy more than that,
+	 * otherwise we read (and disclose) stale kernel heap past the field. */
+	if (sopt->sopt_valsize > sizeof(ctx->sets))
+		sopt->sopt_valsize = sizeof(ctx->sets);
 	bcopy(&ctx->sets, sopt->sopt_val, sopt->sopt_valsize);
 	return 0;
 }