diff --git a/sys/netgraph7/socket/ng_socket.c b/sys/netgraph7/socket/ng_socket.c
index 6a95641b..538bb0ef 100644
--- a/sys/netgraph7/socket/ng_socket.c
+++ b/sys/netgraph7/socket/ng_socket.c
@@ -267,6 +267,20 @@ ngc_send(netmsg_t netmsg)
 		goto release;
 	}
 
+	/*
+	 * DF-3558 / DF-0534: the declared arglen must fit within what was
+	 * actually sent.  Without this, any node that trusts header.arglen
+	 * (e.g. ng_hole passing msg->data to ng_findhook's strcmp) reads
+	 * past the kmalloc'd len+1 buffer and completes "strings" from
+	 * stale heap residue.
+	 */
+	if (len < sizeof(struct ng_mesg) ||
+	    len < sizeof(struct ng_mesg) + msg->header.arglen) {
+		kfree(msg, M_NETGRAPH_MSG);
+		error = EINVAL;
+		goto release;
+	}
+
 	/*
 	 * Hack alert!
 	 * We look into the message and if it mkpeers a node of unknown type, we
diff --git a/sys/netgraph7/hole/ng_hole.c b/sys/netgraph7/hole/ng_hole.c
--- a/sys/netgraph7/hole/ng_hole.c
+++ b/sys/netgraph7/hole/ng_hole.c
@@ -164,6 +164,12 @@ ngh_rcvmsg(node_p node, item_p item, hook_p lasthook)
 				error = EINVAL;
 				break;
 			}
+			/* DF-3558 defense-in-depth: the hook name must be
+			 * NUL-terminated within the advertised length. */
+			if (msg->data[NG_HOOKSIZ - 1] != '\0') {
+				error = EINVAL;
+				break;
+			}
 			/* Find hook. */
 			hook = ng_findhook(node, (char *)msg->data);
 			if (hook == NULL) {