--- a/sys/vfs/nfs/bootp_subr.c
+++ b/sys/vfs/nfs/bootp_subr.c
@@ -717,7 +717,7 @@
 				}
 				hexncpy((u_char *)LLADDR(ifctx->sdl),
 				    ifctx->sdl->sdl_alen, hexstr,
-				    HEX_NCPYLEN(ifctx->sdl->sdl_alen), ":");
+				    sizeof(hexstr), ":");
 				kprintf("Sending %s packet from "
 				       "interface %s (%s)\n",
 				       s, ifctx->ireq.ifr_name,
@@ -1045,11 +1045,20 @@
 	sdl = NULL;
 	TAILQ_FOREACH(ifac, &ifctx->ifp->if_addrheads[mycpuid], ifa_link) {
 		struct ifaddr *ifa = ifac->ifa;
+		struct sockaddr_dl *sdl2;
 
-		if (ifa->ifa_addr->sa_family == AF_LINK &&
-		    (sdl = ((struct sockaddr_dl *) ifa->ifa_addr)) != NULL &&
-		    sdl->sdl_type == IFT_ETHER)
+		if (ifa->ifa_addr->sa_family != AF_LINK)
+			continue;
+		sdl2 = (struct sockaddr_dl *)ifa->ifa_addr;
+		/* Only accept an address that fits chaddr[16] (and is
+		 * nonzero): every byte of it is copied into the BOOTP
+		 * query and compared on replies. */
+		if (sdl2->sdl_type == IFT_ETHER &&
+		    sdl2->sdl_alen > 0 &&
+		    sdl2->sdl_alen <= sizeof(ifctx->call.chaddr)) {
+			sdl = sdl2;
 			break;
+		}
 	}
 
 	if (sdl == NULL)