--- a/sys/net/pf/pf_norm.c
+++ b/sys/net/pf/pf_norm.c
@@ -1937,6 +1964,13 @@
 		}
 		switch (opt) {
 		case TCPOPT_MAXSEG:
+			/* NOTE (DF-3360): a malformed MSS option with
+			 * optlen 2 or 3 at the end of the option space
+			 * made mss point past the 40-byte opts[] array;
+			 * only touch it for well-formed options.
+			 */
+			if (optlen != TCPOLEN_MAXSEG)
+				break;
 			mss = (u_int16_t *)(optp + 2);
 			if ((ntohs(*mss)) > r->max_mss) {
 				th->th_sum = pf_cksum_fixup(th->th_sum,