--- a/sys/netinet6/in6_pcb.c
+++ b/sys/netinet6/in6_pcb.c
@@ -340,6 +340,18 @@
 	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)nam;
 	int error;
 
+	/*
+	 * Validate the sockaddr BEFORE touching any address fields.
+	 * getsockaddr() allocates exactly namelen bytes, so reading
+	 * sin6_addr on a short sockaddr reads past the end of the
+	 * allocation (DF-3357/DF-3372 read-before-validate family).
+	 * Mirrors the checks in in6_pcbbind() above.
+	 */
+	if (nam->sa_len != sizeof(*sin6))
+		return (EINVAL);
+	if (nam->sa_family != AF_INET6)
+		return (EAFNOSUPPORT);
+
 	/* Reject v4-mapped address */
 	if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr))
 		return EADDRNOTAVAIL;