--- a/sys/netgraph/fec/ng_fec.c
+++ b/sys/netgraph/fec/ng_fec.c
@@ -366,6 +366,15 @@
 			    "bundle\n", priv->unit, iface);
 			return(EINVAL);
 		}
+	}
+
+	/* Refuse interfaces already claimed by another netgraph entity:
+	 * cross-bundle enslavement silently steals/blinds RX. */
+	if (((struct arpcom *)bifp)->ac_netgraph != NULL) {
+		ifnet_unlock();
+		kprintf("fec%d: iface %s is already claimed by netgraph\n",
+		    priv->unit, iface);
+		return(EINVAL);
 	}
 
 	/* Allocate new list entry. */
--- a/sys/netgraph/fec/ng_fec.c
+++ b/sys/netgraph/fec/ng_fec.c
@@ -459,6 +459,10 @@
 	sdl = IF_LLSOCKADDR(bifp);
 	bcopy((char *)&p->fec_mac, ac->ac_enaddr, ETHER_ADDR_LEN);
 	bcopy((char *)&p->fec_mac, LLADDR(sdl), ETHER_ADDR_LEN);
+
+	/* Drop our claim on the member so it is not left dangling. */
+	if (((struct arpcom *)bifp)->ac_netgraph == priv->node)
+		((struct arpcom *)bifp)->ac_netgraph = NULL;
 
 	/* Delete port */
 	TAILQ_REMOVE(&b->ng_fec_ports, p, fec_list);