--- zzzz-none-000/linux-4.4.60/net/netfilter/nfnetlink.c	2017-04-08 07:53:53.000000000 +0000
+++ dragonfly-4020-701/linux-4.4.60/net/netfilter/nfnetlink.c	2018-11-08 13:36:17.000000000 +0000
@@ -326,10 +326,12 @@
 		nlh = nlmsg_hdr(skb);
 		err = 0;
 
-		if (nlmsg_len(nlh) < sizeof(struct nfgenmsg) ||
-		    skb->len < nlh->nlmsg_len) {
-			err = -EINVAL;
-			goto ack;
+		if (nlh->nlmsg_len < NLMSG_HDRLEN ||
+		    skb->len < nlh->nlmsg_len ||
+		    nlmsg_len(nlh) < sizeof(struct nfgenmsg)) {
+			nfnl_err_reset(&err_list);
+			status |= NFNL_BATCH_FAILURE;
+			goto done;
 		}
 
 		/* Only requests are handled by the kernel */