diff --git a/sys/dev/netif/ath/ath/if_ath_rx.c b/sys/dev/netif/ath/ath/if_ath_rx.c
--- a/sys/dev/netif/ath/ath/if_ath_rx.c
+++ b/sys/dev/netif/ath/ath/if_ath_rx.c
@@ -770,6 +770,14 @@
 		goto rx_next;
 	}
 rx_accept:
+	/*
+	 * DF-1517: rs->rs_datalen comes from a 12-bit AR_DataLen field on
+	 * ar5416+ (max 4095) but the RX cluster is only MCLBYTES (2048).
+	 * A buggy or malicious NIC could write a length larger than the
+	 * buffer; bound it before assigning to m_len.
+	 */
+	if (rs->rs_datalen > MCLBYTES)
+		goto rx_next;
 	len = rs->rs_datalen;
 	m->m_len = len;