--- a/sys/net/pf/pf.c
+++ b/sys/net/pf/pf.c
@@ -3010,9 +3010,14 @@ pf_get_sport(sa_family_t af, u_int8_t proto, struct pf_rule *r,
 			if (low > high) {
 				tmp = low;
 				low = high;
 				high = tmp;
 			}
+			/*
+			 * The downward loop below uses a u_int16_t counter
+			 * with a `tmp >= low` condition; low == 0 underflows
+			 * at 0 -> 0xffff and never terminates.  The ICMP
+			 * path below already clamps the same way.
+			 */
+			if (low == 0)
+				low = 1;
 			/* low < high */
 			cut = htonl(karc4random()) % (1 + high - low) + low;