--- a/sys/netproto/802_11/wlan/ieee80211_ioctl.c
+++ b/sys/netproto/802_11/wlan/ieee80211_ioctl.c
@@ -2488,14 +2488,19 @@ ieee80211_scanreq(struct ieee80211vap *vap, struct ieee80211_scan_req *sr)
 	if (sr->sr_maxdwell != 0) {
 		sr->sr_maxdwell = msecs_to_ticks(sr->sr_maxdwell);
 		if (sr->sr_maxdwell < 1)
 			sr->sr_maxdwell = 1;
 	}
 	/* NB: silently reduce ssid count to what is supported */
+	/* NB: reject negative count (see also DF-0642, scan.c nssid) */
+	if (sr->sr_nssid < 0)
+		return EINVAL;
 	if (sr->sr_nssid > IEEE80211_SCAN_MAX_SSID)
 		sr->sr_nssid = IEEE80211_SCAN_MAX_SSID;
 	for (i = 0; i < sr->sr_nssid; i++)
-		if (sr->sr_ssid[i].len > IEEE80211_NWID_LEN)
+		if (sr->sr_ssid[i].len < 0 ||
+		    sr->sr_ssid[i].len > IEEE80211_NWID_LEN)
 			return EINVAL;
+
 	/* cleanse flags just in case, could reject if invalid flags */
 	sr->sr_flags &= IEEE80211_IOC_SCAN_FLAGS;
 	/*