diff --git a/sys/netgraph/bpf/ng_bpf.c b/sys/netgraph/bpf/ng_bpf.c
--- a/sys/netgraph/bpf/ng_bpf.c
+++ b/sys/netgraph/bpf/ng_bpf.c
@@ -380,6 +380,17 @@
 	hook_p dest;
 	u_int len;
 
+	/* DF-2595: reject zero-length packets. With totlen==0 the later
+	 * bpf_filter() call gets buflen==0, which in the kernel makes
+	 * bpf_filter() take its mbuf-traversal fallback (bpf_filter.c) and
+	 * cast the flat `data` pointer to (struct mbuf *) -- a type confusion
+	 * that dereferences attacker-influenced bytes as kernel pointers.
+	 * FreeBSD's ng_bpf guards this; DragonFly's did not. */
+	if (totlen == 0) {
+		NG_FREE_DATA(m, meta);
+		return (0);
+	}
+
 	/* Update stats on incoming hook */
 	hip->stats.recvFrames++;
 	hip->stats.recvOctets += totlen;