--- a/sys/netgraph7/ksocket/ng_ksocket.c
+++ b/sys/netgraph7/ksocket/ng_ksocket.c
@@ -903,8 +903,15 @@
 	 */
 	if (((stag = (struct sa_tag *)m_tag_locate(m, NGM_KSOCKET_COOKIE,
 	    NG_KSOCKET_TAG_SOCKADDR, NULL)) != NULL) &&
-	    (stag->id == NG_NODE_ID(node) || stag->id == 0))
+	    (stag->id == NG_NODE_ID(node) || stag->id == 0)) {
+		struct m_tag *mt = &stag->tag;
+
+		if (mt->m_tag_len < sizeof(struct sa_tag) - 1) {
+			NG_FREE_M(m);
+			return (EINVAL);
+		}
 		sa = &stag->sa;
+	}
 
 	/* Reset specific mbuf flags to prevent addressing problems. */
 	m->m_flags &= ~(M_BCAST|M_MCAST);