diff --git a/sys/dev/netif/fwe/if_fwe.c b/sys/dev/netif/fwe/if_fwe.c
--- a/sys/dev/netif/fwe/if_fwe.c
+++ b/sys/dev/netif/fwe/if_fwe.c
@@ -564,6 +564,14 @@
 			continue;
 		}
 
+		/* fp->mode.stream.len is a u16 populated by the OHCI controller from
+		 * the on-wire isochronous header and is attacker-controlled. */
+		if (fp->mode.stream.len > m->m_ext.ext_size) {
+			m_freem(m);
+			IFNET_STAT_INC(ifp, ierrors, 1);
+			continue;
+		}
+
 		m->m_data += HDR_LEN + ETHER_ALIGN;
 		m->m_len = m->m_pkthdr.len =
 				fp->mode.stream.len - ETHER_ALIGN;