NetBSD 3.0 3.1 and 4.0 when a pppoe instance exists does not properly check the length of a PPPoE packet tag which allows remote attackers to cause a denial of service (system crash) via a crafted PPPoE packet.