--- a/sys/netproto/802_11/wlan/ieee80211_output.c
+++ b/sys/netproto/802_11/wlan/ieee80211_output.c
@@ -1785,6 +1785,18 @@
 		("pktlen %u mtu %u", m0->m_pkthdr.len, mtu));
 
 	/*
+	 * Each fragment is built in a single mbuf cluster, so the fragment
+	 * size must stay below MCLBYTES.  iv_fragthreshold is configurable
+	 * up to IEEE80211_FRAG_MAX (2346) which exceeds MCLBYTES (2048);
+	 * without this clamp m_align() computes a negative adjust and
+	 * m_data ends up before the start of the cluster, so the fragment
+	 * copy smashes the heap on non-INVARIANTS kernels (and trips the
+	 * KASSERT below on INVARIANTS kernels).
+	 */
+	if (mtu > MCLBYTES - 1)
+		mtu = MCLBYTES - 1;
+
+	/*
 	 * Honor driver DATAPAD requirement.
 	 */
 	if (ic->ic_flags & IEEE80211_F_DATAPAD)