diff --git a/sys/dev/virtual/virtio/net/if_vtnet.c b/sys/dev/virtual/virtio/net/if_vtnet.c
--- a/sys/dev/virtual/virtio/net/if_vtnet.c
+++ b/sys/dev/virtual/virtio/net/if_vtnet.c
@@ -1715,8 +1715,17 @@
 			adjsz = sizeof(struct vtnet_rx_header);
 			/*
 			 * Account for our pad between the header and
-			 * the actual start of the frame.
+			 * the actual start of the frame.  Reject lengths
+			 * that would overflow signed int when the pad is
+			 * added; a malicious device could otherwise trip
+			 * the m_prev==NULL KASSERT or a NULL deref in
+			 * vtnet_replace_rxbuf (DF-1310).
 			 */
+			if (len > VTNET_MAX_RX_SIZE + sc->vtnet_hdr_size) {
+				ifp->if_ierrors++;
+				vtnet_discard_rxbuf(sc, m);
+				continue;
+			}
 			len += VTNET_RX_HEADER_PAD;
 		} else {
 			mhdr = mtod(m, struct virtio_net_hdr_mrg_rxbuf *);