--- a/sys/vfs/hammer/hammer_reblock.c
+++ b/sys/vfs/hammer/hammer_reblock.c
@@ -317,6 +317,17 @@
 		break;
 	}
 	if (reblock->head.flags & iocflags) {
+		/*
+		 * DF-3033: validate the on-disk leaf data_len before it is
+		 * used as a length anywhere (blockmap getfree, direct
+		 * uncache getblk, extract copy).  Reject anything that is
+		 * not a positive 16K-multiple <= HAMMER_XBUFSIZE.
+		 */
+		if (elm->leaf.data_len <= 0 ||
+		    elm->leaf.data_len > HAMMER_XBUFSIZE ||
+		    (elm->leaf.data_len & HAMMER_BUFMASK)) {
+			goto skip;
+		}
 		++reblock->data_count;
 		reblock->data_byte_count += elm->leaf.data_len;
 		bytes = hammer_blockmap_getfree(hmp, tmp_offset, &cur, &error);