--- a/sys/netproto/802_11/wlan/ieee80211_sta.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/netproto/802_11/wlan/ieee80211_sta.c	2026-10-26 03:31:47.239168522 +0000
@@ -738,6 +738,16 @@
 		 * crypto cipher modules used to do delayed update
 		 * of replay sequence numbers.
 		 */
+		/*
+		 * Guarantee the management header (and any WEP-stripped
+		 * header) is contiguous: chained drivers may deliver
+		 * m_len < sizeof(frame) while m_pkthdr.len is checked.
+		 */
+		if ((m = m_pullup(m, sizeof(struct ieee80211_frame))) == NULL) {
+			vap->iv_stats.is_rx_tooshort++;
+			goto err;
+		}
+		wh = mtod(m, struct ieee80211_frame *);
 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
 			if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
 				/*