diff --git a/sys/net/netmap/netmap_mem2.c b/sys/net/netmap/netmap_mem2.c
--- a/sys/net/netmap/netmap_mem2.c
+++ b/sys/net/netmap/netmap_mem2.c
@@ -176,8 +176,12 @@ netmap_mem_ofstophys(struct netmap_mem_d* nmd, vm_ooffset_t offset)
 	for (i = 0; i < NETMAP_POOLS_NR; offset -= p[i].memtotal, i++) {
 		if (offset >= p[i].memtotal)
 			continue;
+		/* DF-0546: bound lut index to prevent OOB read in page padding */
+		u_int idx = offset / p[i]._objsize;
+		if (idx >= p[i].objtotal)
+			break;
 		// now lookup the cluster's address
-		pa = p[i].lut[offset / p[i]._objsize].paddr +
+		pa = p[i].lut[idx].paddr +
 			offset % p[i]._objsize;
 		NMA_UNLOCK(nmd);
 		return pa;