Index: sys/netinet/tcp_sack.c
===================================================================
--- sys/netinet/tcp_sack.c
+++ sys/netinet/tcp_sack.c
@@ -965,6 +965,15 @@
 		}
 	}
 out:
+	KASSERT(hole->start < hole->end, ("%s: hole.start >= hole.end", __func__));
+	KASSERT(hole->start < tp->snd_fack, ("%s: hole.start >= snd.fack", __func__));
+	KASSERT(hole->end < tp->snd_fack, ("%s: hole.end >= snd.fack", __func__));
+	KASSERT(hole->rxmit < tp->snd_fack, ("%s: hole.rxmit >= snd.fack", __func__));
+	if ((hole->start >= hole->end) ||
+	    (hole->start >= tp->snd_fack) ||
+	    (hole->end >= tp->snd_fack) ||
+	    (hole->rxmit >= tp->snd_fack))
+		return (NULL);
 	return (hole);
 }