diff --git a/sys/net/netmap/netmap_generic.c b/sys/net/netmap/netmap_generic.c
--- a/sys/net/netmap/netmap_generic.c
+++ b/sys/net/netmap/netmap_generic.c
@@ -670,6 +670,13 @@
             if (!m)
                 break;
 	    len = MBUF_LEN(m);
+            /* RX mbufs (jumbo frames, LRO-aggregated chains) can exceed
+             * the fixed-size netmap buffer; bound the copy to
+             * NETMAP_BUF_SIZE, exactly as the TX path does at line 500,
+             * to avoid an out-of-bounds write into the shared netmap
+             * buffer pool. */
+            if (unlikely(len > NETMAP_BUF_SIZE))
+                len = NETMAP_BUF_SIZE;
             m_copydata(m, 0, len, addr);
             ring->slot[j].len = len;
             ring->slot[j].flags = slot_flags;