Index: sys/net/if_bridge.c
===================================================================
RCS file: /usr/ncvs/src/sys/net/if_bridge.c,v
retrieving revision 1.11.2.12.2.3
diff -u -r1.11.2.12.2.3 if_bridge.c
--- sys/net/if_bridge.c	27 Oct 2005 19:43:07 -0000	1.11.2.12.2.3
+++ sys/net/if_bridge.c	22 Jan 2006 18:22:38 -0000
@@ -583,6 +583,7 @@
 			break;
 		}
 
+		bzero(&args, sizeof args);
 		if (bc->bc_flags & BC_F_COPYIN) {
 			error = copyin(ifd->ifd_data, &args, ifd->ifd_len);
 			if (error)
@@ -914,6 +915,7 @@
 
 	count = 0;
 	len = bifc->ifbic_len;
+	bzero(&breq, sizeof breq);
 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 		if (len < sizeof(breq))
 			break;
@@ -953,6 +955,7 @@
 	getmicrotime(&tv);
 
 	len = bac->ifbac_len;
+	bzero(&bareq, sizeof bareq);
 	LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
 		if (len < sizeof(bareq))
 			goto out;
Index: sys/net80211/ieee80211_ioctl.c
===================================================================
RCS file: /usr/ncvs/src/sys/net80211/ieee80211_ioctl.c,v
retrieving revision 1.25.2.3.2.1
diff -u -r1.25.2.3.2.1 ieee80211_ioctl.c
--- sys/net80211/ieee80211_ioctl.c	18 Jan 2006 09:03:36 -0000	1.25.2.3.2.1
+++ sys/net80211/ieee80211_ioctl.c	22 Jan 2006 18:21:50 -0000
@@ -884,7 +884,7 @@
 ieee80211_ioctl_getchanlist(struct ieee80211com *ic, struct ieee80211req *ireq)
 {
 
-	if (sizeof(ic->ic_chan_active) > ireq->i_len)
+	if (sizeof(ic->ic_chan_active) < ireq->i_len)
 		ireq->i_len = sizeof(ic->ic_chan_active);
 	return copyout(&ic->ic_chan_active, ireq->i_data, ireq->i_len);
 }