diff --git a/sys/netinet/cc/cc_newreno.c b/sys/netinet/cc/cc_newreno.c
--- a/sys/netinet/cc/cc_newreno.c
+++ b/sys/netinet/cc/cc_newreno.c
@@ -259,9 +259,9 @@
 			if (IN_CONGRECOVERY(CCV(ccv, t_flags) &&
 			    V_cc_do_abe && V_cc_abe_frlossreduce)) {
 				CCV(ccv, snd_ssthresh) =
-				    ((uint64_t)CCV(ccv, snd_ssthresh) *
-				    (uint64_t)beta) /
-				    (100ULL * (uint64_t)beta_ecn);
+				    max(((uint64_t)CCV(ccv, snd_ssthresh) *
+				    (uint64_t)beta) / (uint64_t)beta_ecn,
+				    2 * mss);
 			}
 			if (!IN_CONGRECOVERY(CCV(ccv, t_flags)))
 				CCV(ccv, snd_ssthresh) = cwin;
@@ -341,11 +341,15 @@
 		}
 		switch (opt->name) {
 		case CC_NEWRENO_BETA:
+			if (opt->val == 0 || opt->val > 100)
+				return (EINVAL);
 			nreno->beta = opt->val;
 			break;
 		case CC_NEWRENO_BETA_ECN:
 			if (!V_cc_do_abe)
 				return (EACCES);
+			if (opt->val == 0 || opt->val > 100)
+				return (EINVAL);
 			nreno->beta_ecn = opt->val;
 			break;
 		default: