--- sys/net/ipfw3/ip_fw3_set.c	2026-06-29 12:51:19.000000000 +0000
+++ /tmp/opencode/fixsrc/sys/net/ipfw3/ip_fw3_set.c	2026-10-24 13:17:17.399469530 +0000
@@ -101,6 +101,9 @@
 	struct netmsg_sets msg;
 	int *set1, *set2;
 
+	/* DF-2593 fix */
+	if (sopt->sopt_valsize < 2 * sizeof(int))
+		return (EINVAL);
 	ctx = fw3_ctx[mycpuid];
 	set1 =(int *)sopt->sopt_val;
 	set2 = set1 + 1;
@@ -136,6 +139,9 @@
 	struct netmsg_sets msg;
 	int *rule_num, *set;
 
+	/* DF-2593 fix */
+	if (sopt->sopt_valsize < 2 * sizeof(int))
+		return (EINVAL);
 	ctx = fw3_ctx[mycpuid];
 	rule_num =(int *)sopt->sopt_val;
 	set = rule_num + 1;
@@ -173,6 +179,9 @@
 	struct netmsg_sets msg;
 	int *set1, *set2;
 
+	/* DF-2593 fix */
+	if (sopt->sopt_valsize < 2 * sizeof(int))
+		return (EINVAL);
 	ctx = fw3_ctx[mycpuid];
 	set1 =(int *)sopt->sopt_val;
 	set2 = set1 + 1;
@@ -196,6 +205,9 @@
 
 	ctx = fw3_ctx[mycpuid];
 
+	/* DF-2593 fix */
+	if (sopt->sopt_valsize < sizeof(int))
+		return (EINVAL);
 	num =(int *)sopt->sopt_val;
 	if (*num > 0 && *num < 32) {
 		ctx->sets = ctx->sets ^ (1 << *num);
@@ -240,6 +252,9 @@
 	struct netmsg_sets msg;
 	int *num;
 
+	/* DF-2593 fix */
+	if (sopt->sopt_valsize < sizeof(int))
+		return (EINVAL);
 	num =(int *)sopt->sopt_val;
 	if (*num > 0 && *num < 32) {
 		bzero(&msg, sizeof(msg));