diff --git a/sys/dev/netif/sn/if_sn.c b/sys/dev/netif/sn/if_sn.c
--- a/sys/dev/netif/sn/if_sn.c
+++ b/sys/dev/netif/sn/if_sn.c
@@ -987,6 +987,16 @@
 	 * extra word with the control byte.
 	 */
 	packet_length -= 6;
+	/*
+	 * DF-1551: packet_length is u_short; if RLEN_MASK gave < 6 (the
+	 * 3 header words), the subtraction silently wraps to ~65530 and
+	 * the subsequent insw() writes ~32K words into a 2KB cluster.
+	 * Treat anything that underflows as an error.
+	 */
+	if (packet_length > MCLBYTES) {
+		IFNET_STAT_INC(ifp, ierrors, 1);
+		goto out;
+	}
 
 	/*
 	 * Account for receive errors and discard.