diff --git a/sys/bus/u4b/wlan/if_run.c b/sys/bus/u4b/wlan/if_run.c
--- a/sys/bus/u4b/wlan/if_run.c
+++ b/sys/bus/u4b/wlan/if_run.c
@@ -3009,8 +3009,11 @@
 			break;
 		}
 
-		/* copy aggregated frames to another mbuf */
-		m0 = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
+		/* copy aggregated frames to another mbuf.
+		 * The copy is dmalen + sizeof(struct rt2870_rxd) bytes; dmalen is
+		 * bounded only by RUN_MAX_RXSZ (4096), so the destination must be a
+		 * jumbo cluster (MJUMPAGESIZE), not a plain MCLBYTES (2048) cluster. */
+		m0 = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR, MJUMPAGESIZE);
 		if (__predict_false(m0 == NULL)) {
 			DPRINTF("could not allocate mbuf\n");
 #if defined(__DragonFly__)