Index: sys/netinet/raw_ip.c =================================================================== --- sys/netinet/raw_ip.c (revision 310879) +++ sys/netinet/raw_ip.c (working copy) @@ -508,7 +508,7 @@ * and don't allow packet length sizes that will crash. */ if (((ip->ip_hl != (sizeof (*ip) >> 2)) && inp->inp_options) - || (ntohs(ip->ip_len) > m->m_pkthdr.len) + || (ntohs(ip->ip_len) != m->m_pkthdr.len) || (ntohs(ip->ip_len) < (ip->ip_hl << 2))) { INP_RUNLOCK(inp); m_freem(m);