--- a/sys/vfs/nfs/nfs_socket.c
+++ b/sys/vfs/nfs/nfs_socket.c
@@ -649,8 +649,13 @@
 			/*
 			 * This is SERIOUS! We are out of sync with the sender
 			 * and forcing a disconnect/reconnect is all I can do.
+			 *
+			 * A zero-length record is not a valid SunRPC reply.
+			 * Accepting it leaves *mp NULL and nfs_reply() would
+			 * then dereference it via mtod().  The server side
+			 * (nfsrv_getstream) already rejects reclen <= 0.
 			 */
-			if (len > NFS_MAXPACKET) {
+			if (len == 0 || len > NFS_MAXPACKET) {
 			    log(LOG_ERR, "%s (%d) from nfs server %s\n",
 				"impossible packet length",
 				len,
@@ -669,6 +674,8 @@
 						     NULL, &rcvflg);
 			} while (error == EWOULDBLOCK || error == EINTR ||
 				 error == ERESTART);
+			if (error == 0 && sio.sb_mb == NULL)
+				error = EPIPE;
 			if (error == 0 && sio.sb_cc != len) {
 			    if (sio.sb_cc != 0) {
 				log(LOG_INFO,