diff --git a/sys/compat/common/uipc_syscalls_40.c b/sys/compat/common/uipc_syscalls_40.c
index 8e3c16086857..673b5c4116d7 100644
--- a/sys/compat/common/uipc_syscalls_40.c
+++ b/sys/compat/common/uipc_syscalls_40.c
@@ -41,7 +41,6 @@ compat_ifconf(u_long cmd, void *data)
 	struct oifreq ifr, *ifrp = NULL;
 	int space = 0, error = 0;
 	const int sz = (int)sizeof(ifr);
-	const bool docopy = ifc->ifc_req != NULL;
 	int s;
 	int bound;
 	struct psref psref;
@@ -54,6 +53,7 @@ compat_ifconf(u_long cmd, void *data)
 		return ENOSYS;
 	}
 
+	const bool docopy = ifc->ifc_req != NULL;
 	if (docopy) {
 		if (ifc->ifc_len < 0)
 			return EINVAL;
diff --git a/sys/net/if.c b/sys/net/if.c
index 78130415225f..a6f30cc65d11 100644
--- a/sys/net/if.c
+++ b/sys/net/if.c
@@ -3450,6 +3450,9 @@ doifioctl(struct socket *so, u_long cmd, void *data, struct lwp *l)
 		}
 	}
 
+	if ((cmd & IOC_IN) == 0 || IOCPARM_LEN(cmd) < sizeof(ifr->ifr_name))
+		return EINVAL;
+
 	bound = curlwp_bind();
 	ifp = if_get(ifr->ifr_name, &psref);
 	if (ifp == NULL) {