diff --git a/sys/dev/netif/sf/if_sf.c b/sys/dev/netif/sf/if_sf.c
--- a/sys/dev/netif/sf/if_sf.c
+++ b/sys/dev/netif/sf/if_sf.c
@@ -948,6 +948,16 @@
 			continue;
 		}
 
+		/*
+		 * DF-1526: sf_len is a 16-bit field written by the NIC into
+		 * DMA-coherent memory.  m_devget bcopy()s sf_len+ETHER_ALIGN
+		 * bytes from the cluster (sized MCLBYTES-8 after m_adj of
+		 * sizeof(u_int64_t) in sf_newbuf).  Clamp sf_len before the
+		 * copy so we cannot read past the cluster.
+		 */
+		if (cur_rx->sf_len > (MCLBYTES - sizeof(u_int64_t) - ETHER_ALIGN))
+			cur_rx->sf_len = MCLBYTES - sizeof(u_int64_t) - ETHER_ALIGN;
+
 		m0 = m_devget(mtod(m, char *) - ETHER_ALIGN,
 			      cur_rx->sf_len + ETHER_ALIGN, 0, ifp);
 		sf_newbuf(sc, desc, m);