diff --git a/sys/dev/virtual/vmware/vmxnet3/if_vmx.c b/sys/dev/virtual/vmware/vmxnet3/if_vmx.c
--- a/sys/dev/virtual/vmware/vmxnet3/if_vmx.c
+++ b/sys/dev/virtual/vmware/vmxnet3/if_vmx.c
@@ -2087,6 +2087,12 @@
 			rxr = &rxq->vxrxq_cmd_ring[0];
 		else
 			rxr = &rxq->vxrxq_cmd_ring[1];
+		if (idx >= (int)rxr->vxrxr_ndesc) {
+			device_printf(sc->vmx_dev, "%s: rxcd idx %d out of range "
+			    "[0,%u), dropping chain\n", __func__, idx,
+			    rxr->vxrxr_ndesc);
+			break;
+		}
 		vmxnet3_rxq_eof_discard(rxq, rxr, idx);
 	} while (!eof);
 }
@@ -2218,6 +2224,14 @@
 			rxr = &rxq->vxrxq_cmd_ring[0];
 		else
 			rxr = &rxq->vxrxq_cmd_ring[1];
+		if (idx >= (int)rxr->vxrxr_ndesc) {
+			device_printf(sc->vmx_dev, "%s: rxcd idx %d out of range "
+			    "[0,%u), stopping RX processing\n", __func__, idx,
+			    rxr->vxrxr_ndesc);
+			rxq->vxrxq_mhead = m_head;
+			rxq->vxrxq_mtail = m_tail;
+			break;
+		}
 		rxd = &rxr->vxrxr_rxd[idx];
 
 		m = rxr->vxrxr_rxbuf[idx].vrxb_m;