diff --git a/sys/dev/netif/lge/if_lge.c b/sys/dev/netif/lge/if_lge.c
--- a/sys/dev/netif/lge/if_lge.c
+++ b/sys/dev/netif/lge/if_lge.c
@@ -868,6 +868,15 @@
 		m = cur_rx->lge_mbuf;
 		cur_rx->lge_mbuf = NULL;
 		total_len = LGE_RXBYTES(cur_rx);
+
+		/*
+		 * DF-1519: LGE_RXBYTES is a 16-bit DMA-coherent field
+		 * (0..65535) written by the NIC.  The jumbo RX cluster is
+		 * LGE_JUMBO_FRAMELEN (9018) bytes; clamp before the mbuf
+		 * length assignment so we cannot walk past it.
+		 */
+		if (total_len > (LGE_JUMBO_FRAMELEN - ETHER_ALIGN))
+			total_len = LGE_JUMBO_FRAMELEN - ETHER_ALIGN;
 		LGE_INC(i, LGE_RX_LIST_CNT);
 		c--;