diff --git a/sys/bus/u4b/wlan/if_urtwn.c b/sys/bus/u4b/wlan/if_urtwn.c
--- a/sys/bus/u4b/wlan/if_urtwn.c
+++ b/sys/bus/u4b/wlan/if_urtwn.c
@@ -981,7 +981,10 @@
 
 	/* Process all of them. */
 	while (npkts-- > 0) {
-		if (len < sizeof(*stat))
+		/* 'len' is signed; after 128-byte alignment rounding it can go
+		   negative, which sign-promotes to a huge unsigned and defeats
+		   this guard.  Check both signs explicitly. */
+		if (len <= 0 || (unsigned)len < sizeof(*stat))
 			break;
 		stat = (struct r92c_rx_stat *)buf;
 		rxdw0 = le32toh(stat->rxdw0);