diff --git a/sys/dev/netif/wb/if_wb.c b/sys/dev/netif/wb/if_wb.c
--- a/sys/dev/netif/wb/if_wb.c
+++ b/sys/dev/netif/wb/if_wb.c
@@ -1271,7 +1271,15 @@
 		frag = 1;
 	}
 
+	/*
+	 * DF-1487: if the chain consumed all WB_MAXFRAGS(16) descriptors and
+	 * the total length is still < WB_MIN_FRAMELEN, the padding write would
+	 * land at wb_frag[16] — one past the array.  Refuse the encap so the
+	 * caller requeues/coalesces instead of corrupting adjacent heap.
+	 */
 	if (total_len < WB_MIN_FRAMELEN) {
+		if (frag >= WB_MAXFRAGS)
+			return(1);
 		f = &c->wb_ptr->wb_frag[frag];
 		f->wb_ctl = WB_MIN_FRAMELEN - total_len;
 		f->wb_data = vtophys(&sc->wb_cdata.wb_pad);