diff --git a/sys/dev/netif/ae/if_ae.c b/sys/dev/netif/ae/if_ae.c
--- a/sys/dev/netif/ae/if_ae.c
+++ b/sys/dev/netif/ae/if_ae.c
@@ -612,6 +612,10 @@
 		if_printf(ifp, "Runt frame received.");
 		return (EIO);
 	}
+	if (size > sizeof(rxd->data)) {
+		if_printf(ifp, "Oversized frame received (size=%u)\n", size);
+		return (EIO);
+	}
 
 	m = m_devget(&rxd->data[0], size, 0, ifp);
 	if (m == NULL)