diff --git a/sys/bus/u4b/wlan/if_rum.c b/sys/bus/u4b/wlan/if_rum.c
--- a/sys/bus/u4b/wlan/if_rum.c
+++ b/sys/bus/u4b/wlan/if_rum.c
@@ -1217,8 +1217,18 @@
 			m->m_flags |= M_WEP;
 		}
 
-		/* finalize mbuf */
-		m->m_pkthdr.len = m->m_len = (flags >> 16) & 0xfff;
+		/* finalize mbuf: clamp the device-reported frame length to the actual
+		 * USB transfer length (and the cluster capacity), matching if_mtw/if_run.
+		 * Without this, a malicious device can advertise up to 4095 bytes and
+		 * expose uninitialized / out-of-bounds cluster memory to readers. */
+		{
+			int rlen = (flags >> 16) & 0xfff;
+			if (rlen > len)
+				rlen = len;
+			if (rlen > MCLBYTES)
+				rlen = MCLBYTES;
+			m->m_pkthdr.len = m->m_len = rlen;
+		}
 
 		if (ieee80211_radiotap_active(ic)) {
 			struct rum_rx_radiotap_header *tap = &sc->sc_rxtap;