--- a/sys/netproto/802_11/wlan/ieee80211_hwmp.c
+++ b/sys/netproto/802_11/wlan/ieee80211_hwmp.c
@@ verify_mesh_preq_len / verify_mesh_perr_len
 	Validate iefrm[1] (declared IE length) against the required field
 	offsets BEFORE reading iefrm[2] / iefrm[TCNT_OFFSET] / iefrm[NDEST]:
 
+	if (iefrm[1] < IEEE80211_MESHPREQ_TCNT_OFFSET_AE + 1)
+		return (-1);	/* preq: before reading flags/target-count */
+	if (iefrm[1] < IEEE80211_MESHPERR_NDEST_OFFSET + 1)
+		return (-1);	/* perr: before reading ndest */
 	... and bound the PERR destination walk by the remaining declared
 	length (stop when iefrm_t exceeds iefrm + iefrm[1] + 2).