--- a/sys/netproto/802_11/wlan/ieee80211_sta.c +++ b/sys/netproto/802_11/wlan/ieee80211_sta.c @@ -641,6 +641,11 @@ ieee80211_sta_input(...) if ( IEEE80211_HAS_SEQ(type, subtype) && !IEEE80211_IS_MULTICAST(wh->i_addr1)) { + /* DF-3342: pre-dispatch seq/QoS reads need the full + * header present (mirror of DF-3325) */ + if (m->m_pkthdr.len < + (IEEE80211_QOS_HAS_SEQ(wh) ? + sizeof(struct ieee80211_qosframe) : + sizeof(struct ieee80211_frame))) + goto out; uint8_t tid = ieee80211_gettid(wh);