--- a/sys/net/ipfw/ip_fw2.c
+++ b/sys/net/ipfw/ip_fw2.c
@@ -5479,10 +5479,16 @@ ipfw_check_ioc_rule(struct ipfw_ioc_rule *rule, int size, uint32_t *rule_flags)
 		case O_RECV:
 		case O_XMIT:
 		case O_VIA:
 			if (cmdlen != F_INSN_SIZE(ipfw_insn_if))
 				goto bad_size;
+			/* name[] is the trailing IFNAMSIZ bytes of the
+			 * instruction and feeds kfnmatch() as a C string;
+			 * require termination so the glob scan cannot run
+			 * off the end of the rule allocation. */
+			if (((ipfw_insn_if *)cmd)->name[0] != '\0' &&
+			    memchr(((ipfw_insn_if *)cmd)->name, 0,
+				   IFNAMSIZ) == NULL)
+				goto bad_size;
 			break;