diff --git a/sys/netpfil/ipfilter/netinet/fil.c b/sys/netpfil/ipfilter/netinet/fil.c
--- a/sys/netpfil/ipfilter/netinet/fil.c
+++ b/sys/netpfil/ipfilter/netinet/fil.c
@@ -4729,7 +4729,7 @@
 		case FRI_NETWORK :
 		case FRI_NETMASKED :
 		case FRI_PEERADDR :
-			if (fp->fr_sifpidx < 0) {
+			if (fp->fr_sifpidx < 0 || fp->fr_sifpidx > fp->fr_namelen) {
 				IPFERROR(23);
 				error = EINVAL;
 			}