--- a/sys/net/netmap/netmap_vale.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/net/netmap/netmap_vale.c	2026-09-11 14:28:49.697863303 +0000
@@ -1500,7 +1500,10 @@
 	/* skip past packets that userspace has released */
 	j = kring->nr_hwcur;    /* netmap ring index */
 	if (resvd > 0) {
-		if (resvd + ring->avail >= lim + 1) {
+		/* also reject resvd >= ring size: (resvd + avail) can wrap
+		 * uint32 and smuggle an out-of-range reserved value past
+		 * the check below, making k leave the ring index space. */
+		if (resvd >= lim + 1 || resvd + ring->avail >= lim + 1) {
 			D("XXX invalid reserve/avail %d %d", resvd, ring->avail);
 			ring->reserved = resvd = 0; // XXX panic...
 		}