diff --git a/src/libsystemd-network/test-dhcp6-client.c b/src/libsystemd-network/test-dhcp6-client.c
index 26025a2fa4..bcd0134a8d 100644
--- a/src/libsystemd-network/test-dhcp6-client.c
+++ b/src/libsystemd-network/test-dhcp6-client.c
@@ -366,6 +366,56 @@ static void test_option_status(void) {
         dhcp6_lease_free_ia(&pd);
 }
 
+static void test_client_parse_message_issue_22099(void) {
+        static const uint8_t msg[] = {
+                /* xid */
+                0x07, 0x7c, 0x4c, 0x16,
+                /* status code (zero length) */
+                0x00, 0x0e, 0x00, 0x00,
+                /* NTP servers (broken sub option and sub option length) */
+                0x00, 0x38, 0x00, 0x14, 0x01, 0x00, 0x10, 0x00, 0xfd, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                0xde, 0x15, 0xc8, 0xff, 0xfe, 0xef, 0x1e, 0x4e,
+                /* client ID */
+                0x00, 0x01, 0x00, 0x0e, 0x00, 0x02, 0x00, 0x00, 0xab, 0x11, 0x5c, 0x6b, 0x90, 0xec, 0xda, 0x95,
+                0x15, 0x45,
+                /* server ID */
+                0x00, 0x02, 0x00, 0x0a, 0x00, 0x03, 0x00, 0x01, 0xdc, 0x15, 0xc8, 0xef, 0x1e, 0x4e,
+                /* preference */
+                0x00, 0x07, 0x00, 0x01, 0x00,
+                /* DNS servers */
+                0x00, 0x17, 0x00, 0x10, 0xfd, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xde, 0x15, 0xc8, 0xff,
+                0xfe, 0xef, 0x1e, 0x4e,
+                /* v6 pcp server */
+                0x00, 0x56, 0x00, 0x10, 0x2a, 0x02, 0x81, 0x0d, 0x98, 0x80, 0x37, 0x00, 0xde, 0x15, 0xc8, 0xff,
+                0xfe, 0xef, 0x1e, 0x4e,
+                /* IA_NA */
+                0x00, 0x03, 0x00, 0x28, 0xcc, 0x59, 0x11, 0x7b, 0x00, 0x00, 0x07, 0x08, 0x00, 0x00, 0x0b, 0x40,
+                /* IA_NA (iaaddr) */
+                0x00, 0x05, 0x00, 0x18, 0x2a, 0x02, 0x81, 0x0d, 0x98, 0x80, 0x37, 0x00, 0x6a, 0x05, 0xca, 0xff,
+                0xfe, 0xf1, 0x51, 0x53, 0x00, 0x00, 0x0e, 0x10, 0x00, 0x00, 0x1c, 0x20,
+                /* IA_PD */
+                0x00, 0x19, 0x00, 0x29, 0xcc, 0x59, 0x11, 0x7b, 0x00, 0x00, 0x07, 0x08, 0x00, 0x00, 0x0b, 0x40,
+                /* IA_PD (iaprefix) */
+                0x00, 0x1a, 0x00, 0x19, 0x00, 0x00, 0x0e, 0x10, 0x00, 0x00, 0x1c, 0x20, 0x3a, 0x2a, 0x02, 0x81,
+                0x0d, 0x98, 0x80, 0x37, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        };
+        static const uint8_t duid[] = {
+                0x00, 0x00, 0xab, 0x11, 0x5c, 0x6b, 0x90, 0xec, 0xda, 0x95, 0x15, 0x45,
+        };
+        _cleanup_(sd_dhcp6_client_unrefp) sd_dhcp6_client *client = NULL;
+        _cleanup_(sd_dhcp6_lease_unrefp) sd_dhcp6_lease *lease = NULL;
+
+        log_debug("/* %s */", __func__);
+
+        assert_se(sd_dhcp6_client_new(&client) >= 0);
+        assert_se(sd_dhcp6_client_set_iaid(client, 0xcc59117b) >= 0);
+        assert_se(sd_dhcp6_client_set_duid(client, 2, duid, sizeof(duid)) >= 0);
+
+        assert_se(dhcp6_lease_new(&lease) >= 0);
+
+        assert_se(client_parse_message(client, (DHCP6Message*) msg, sizeof(msg), lease) >= 0);
+}
+
 static uint8_t msg_advertise[198] = {
         0x02, 0x0f, 0xb4, 0xe5, 0x00, 0x01, 0x00, 0x0e,
         0x00, 0x01, 0x00, 0x01, 0x1a, 0x6b, 0xf3, 0x30,
@@ -972,6 +1022,7 @@ int main(int argc, char *argv[]) {
         test_parse_domain();
         test_option();
         test_option_status();
+        test_client_parse_message_issue_22099();
         test_advertise_option(e);
         test_client_solicit(e);