--- a/sys/net/dummynet/ip_dummynet.c
+++ b/sys/net/dummynet/ip_dummynet.c
@@ -617,10 +617,14 @@
      */
     if (p->numbytes < 0) { /* This implies bandwidth>0 */
 	dn_key t = 0; /* Number of ticks i have to wait */
+	struct dn_pkt *last;
 
 	if (p->bandwidth > 0)
 	    t = (p->bandwidth - 1 - p->numbytes) / p->bandwidth;
-	TAILQ_LAST(&p->p_queue, dn_pkt_queue)->output_time += t;
+	/* Guard against a NULL deref if the delay line is empty */
+	last = TAILQ_LAST(&p->p_queue, dn_pkt_queue);
+	if (last != NULL)
+	    last->output_time += t;
 	p->sched_time = curr_time;
 
 	/*
@@ -1479,6 +1483,14 @@
     if (ioc_pipe->pipe_nr > DN_PIPE_NR_MAX || ioc_pipe->pipe_nr < 0)
 	return EINVAL;
 
+    /*
+     * Bandwidth is bits/second, 0 means no limit.  A negative value
+     * breaks the WF2Q credit arithmetic (numbytes/t computations below
+     * and in ready_event_wfq()), so reject it outright.
+     */
+    if (ioc_pipe->bandwidth < 0)
+	return EINVAL;
+
     lockmgr(&dn_lock, LK_EXCLUSIVE);
     error = EINVAL;