diff --git a/sys/dev/netif/ste/if_ste.c b/sys/dev/netif/ste/if_ste.c
--- a/sys/dev/netif/ste/if_ste.c
+++ b/sys/dev/netif/ste/if_ste.c
@@ -690,6 +690,16 @@
 			continue;
 		}
 
+		/*
+		 * DF-1514: STE_RXSTAT_FRAMELEN is a 13-bit field written by
+		 * the NIC into DMA-coherent memory and trusted unconditionally.
+		 * With MCLBYTES (2048) cluster + ETHER_ALIGN (2) m_adj the
+		 * usable buffer is 2046 bytes; values up to 8191 would walk
+		 * past the cluster.  Clamp before assigning to m_len.
+		 */
+		if (total_len > MCLBYTES - ETHER_ALIGN)
+			total_len = MCLBYTES - ETHER_ALIGN;
+
 		IFNET_STAT_INC(ifp, ipackets, 1);
 		m->m_pkthdr.rcvif = ifp;
 		m->m_pkthdr.len = m->m_len = total_len;