diff --git a/sys/dev/netif/sbsh/if_sbsh.c b/sys/dev/netif/sbsh/if_sbsh.c
--- a/sys/dev/netif/sbsh/if_sbsh.c
+++ b/sys/dev/netif/sbsh/if_sbsh.c
@@ -780,8 +780,11 @@
 		sc->rq[sc->tail_rq++] = m;
 		sc->tail_rq &= (RQLEN - 1);
 
+		/* Limit DMA length to the actual receive cluster space to avoid a
+		 * 1-2 byte heap overflow when the device writes a max-sized frame
+		 * into the m_adj(m,2)-shrunk cluster. */
 		sc->rbd[cur_rbd].address = vtophys(mtod(m, vm_offset_t));
-		sc->rbd[cur_rbd].length  = 0;
+		sc->rbd[cur_rbd].length  = MCLBYTES - 2;
 		sc->regs->LRDR = cur_rbd = (cur_rbd + 1) & 0x7f;
 	}
 }