--- a/sys/net/rtsock.c
+++ b/sys/net/rtsock.c
@@ rt_msg_buffer / rt_msg_mbuf (both builders)
 		rtinfo->rti_addrs |= (1 << i);
+		/* DF-3359: clamp the SOURCE read; a producer sa_len larger
+		 * than its allocation must not over-read */
+		if (sa->sa_len == 0 || sa->sa_len > sizeof(struct sockaddr_storage)) {
+			bzero(&ss, sizeof(ss));
+			ss.ss_family = sa->sa_family;
+			sa = (struct sockaddr *)&ss;
+		}
 		dlen = RT_ROUNDUP(sa->sa_len);
 		bcopy(sa, cp, dlen);		(= m_copyback in the mbuf twin)