--- a/sys/netgraph/pppoe/ng_pppoe.c	2026-09-13 19:46:06.589509183 +0000
+++ b/sys/netgraph/pppoe/ng_pppoe.c	2026-09-13 19:46:06.613508880 +0000
@@ -1311,6 +1311,19 @@
 			ph = &wh->ph;
 			length = ntohs(wh->ph.length);
 			code = wh->ph.code; 
+
+			/*
+			 * get_tag()/scan_tags() below walk the tag area
+			 * bounded by ph->length ("assume we already sanity
+			 * checked ph->length"); validate that bound against
+			 * the actual packet length exactly as the session
+			 * branch below does. m_pullup() above guarantees
+			 * m_pkthdr.len >= sizeof(*wh), so the subtraction
+			 * cannot underflow.
+			 */
+			if (m->m_pkthdr.len - sizeof(*wh) < length)
+				LEAVE(EMSGSIZE);
+
 			if ( code != PADI_CODE) {
 				LEAVE(EINVAL);
 			}