--- a/sys/vfs/nfs/bootp_subr.c
+++ b/sys/vfs/nfs/bootp_subr.c
@@ -1285,6 +1285,10 @@
 			return;
 		}
 		len = *j++;
+		if (code == TAG_OVERLOAD && len != 1) {
+			tctx->badopt = 1;
+			return;
+		}
 		if (code == tag) {
 			if (tctx->taglen + len > TAG_MAXLEN) {
 				tctx->badtag = 1;