--- a/sys/vfs/hammer2/hammer2_chain.c
+++ b/sys/vfs/hammer2/hammer2_chain.c
@@ -5781,6 +5781,7 @@
 	if (chain->bref.type == HAMMER2_BREF_TYPE_DIRENT &&
 	    chain->bref.embed.dirent.namlen == name_len) {
 		if (name_len > sizeof(chain->bref.check.buf) &&
+		    name_len <= (size_t)chain->bytes &&
 		    bcmp(chain->data->buf, name, name_len) == 0) {
 			return 1;
 		}
--- a/sys/vfs/hammer2/hammer2_vnops.c
+++ b/sys/vfs/hammer2/hammer2_vnops.c
@@ -723,8 +723,16 @@
 			namlen = bref.embed.dirent.namlen;
 			if (namlen <= sizeof(bref.check.buf)) {
 				dname = bref.check.buf;
-			} else {
+			} else if (namlen <=
+				   (1U << (bref.data_off &
+					   HAMMER2_OFF_MASK_RADIX))) {
 				dname = hammer2_xop_gdata(&xop->head)->buf;
+			} else {
+				/*
+				 * DF-2619: namlen exceeds the dirent's
+				 * data block; skip the malformed entry.
+				 */
+				continue;
 			}
 			r = vop_write_dirent(&error, uio,
 					     bref.embed.dirent.inum, dtype,