--- a/sys/netinet6/in6_cksum.c	2026-09-13 07:34:39.282236636 +0000
+++ b/sys/netinet6/in6_cksum.c	2026-09-13 07:34:39.302236380 +0000
@@ -113,7 +113,9 @@
 	} l_util;
 
 	/* sanity check */
-	if (m->m_pkthdr.len < off + len) {
+	/* overflow-safe: never trust (off + len) to not wrap u32 */
+	if (len > (u_int32_t)m->m_pkthdr.len ||
+	    off > (u_int32_t)m->m_pkthdr.len - len) {
 		panic("in6_cksum: mbuf len (%d) < off+len (%d+%d)",
 			m->m_pkthdr.len, off, len);
 	}