diff --git a/sys/net/netmap/netmap_vale.c b/sys/net/netmap/netmap_vale.c
--- a/sys/net/netmap/netmap_vale.c
+++ b/sys/net/netmap/netmap_vale.c
@@ -985,6 +985,15 @@
 		struct netmap_slot *slot = &ring->slot[j];
 		char *buf;
 
+		/* Validate slot length against the bridge buffer size, mirroring
+		 * the check in netmap.c:netmap_bwrap_flush()/nm_bdg_flush_new().
+		 * Without this, a userspace-mapped VALE TX ring can set slot->len
+		 * up to 65535 and nm_bdg_flush() will pkt_copy/copyin that many
+		 * bytes into a NETMAP_BDG_BUF_SIZE (default 2048) buffer. */
+		if (slot->len > NETMAP_BDG_BUF_SIZE(na->up.nm_mem)) {
+			RD(5, "dropping oversize slot len %d", slot->len);
+			continue;
+		}
 		ft[ft_i].ft_len = slot->len;
 		ft[ft_i].ft_flags = slot->flags;