--- a/sys/netgraph7/pppoe/ng_pppoe.c
+++ b/sys/netgraph7/pppoe/ng_pppoe.c
@@ -1201,6 +1201,16 @@
 		session = ntohs(wh->ph.sid);
 		length = ntohs(wh->ph.length);
 		code = wh->ph.code;
+
+		/*
+		 * get_tag()/scan_tags() below walk the tag area bounded
+		 * by ph->length ("assume we already sanity checked
+		 * ph->length"); verify that bound against the actual
+		 * packet length, as the session branch already does.
+		 */
+		if (m->m_pkthdr.len < (int)(sizeof(*wh) + length))
+			LEAVE(EMSGSIZE);
+
 		/* Use peers mode in session. */
 		neg->pkt->pkt_header.eh.ether_type = wh->eh.ether_type;
 		if (code != PADI_CODE)