--- a/sys/net/ipfw/ip_fw2.c
+++ b/sys/net/ipfw/ip_fw2.c
@@ -5328,9 +5328,15 @@ ipfw_check_ioc_rule(struct ipfw_ioc_rule *rule, int size, uint32_t *rule_flags)
 	/* Check rule number */
 	if (rule->rulenum == IPFW_DEFAULT_RULE) {
 		kprintf("ipfw: invalid rule number\n");
 		return EINVAL;
 	}
+	/* The set subsystem (disable/move/swap) is defined for 0..31 only;
+	 * classification computes ipfw_set_disable & (1 << set) whose shift
+	 * is undefined for set >= 32. */
+	if (rule->set >= IPFW_DEFAULT_SET) {
+		kprintf("ipfw: invalid set %u\n", rule->set);
+		return EINVAL;
+	}
 
 	/*
 	 * Now go for the individual checks. Very simple ones, basically only